Publish Advisories

GHSA-58xv-7h9r-mx3c GHSA-86xw-vmcx-9mj4 GHSA-x6v2-xmrq-574j
2026-05-22 18:04:22 -07:00 · 2024-05-15 20:55:52 +00:00
parent 1d4396e0c8
commit fc5b9498f9
3 changed files with 234 additions and 0 deletions
@@ -0,0 +1,77 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-58xv-7h9r-mx3c",
+  "modified": "2024-05-15T20:55:22Z",
+  "published": "2024-05-15T20:55:22Z",
+  "aliases": [
+
+  ],
+  "summary": "Drupal Malicious file upload with filenames stating with dot",
+  "details": "Drupal 8 core's file_save_upload() function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did.\n\nUsers with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to bypass protections afforded by Drupal's default .htaccess file.\n\nAfter this fix, file_save_upload() now trims leading and trailing dots from filenames.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/drupal"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.0.0"
+            },
+            {
+              "fixed": "8.7.11"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/drupal"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.8.0"
+            },
+            {
+              "fixed": "8.8.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2019-12-18-2.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/drupal/drupal"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.drupal.org/sa-core-2019-010"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-434"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-15T20:55:22Z",
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,77 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-86xw-vmcx-9mj4",
+  "modified": "2024-05-15T20:53:24Z",
+  "published": "2024-05-15T20:53:24Z",
+  "aliases": [
+
+  ],
+  "summary": "Drupal Content moderation Access bypass",
+  "details": "In some conditions, drupal content moderation fails to check a users access to use certain transitions, leading to an access bypass.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/drupal"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.0.0"
+            },
+            {
+              "fixed": "8.5.8"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/drupal"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.6.0"
+            },
+            {
+              "fixed": "8.6.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-1.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/drupal/drupal"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.drupal.org/sa-core-2018-006"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-15T20:53:24Z",
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,80 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x6v2-xmrq-574j",
+  "modified": "2024-05-15T20:54:52Z",
+  "published": "2024-05-15T20:54:52Z",
+  "aliases": [
+
+  ],
+  "summary": "Drupal Anonymous Open Redirect",
+  "details": "Drupal core and contributed modules frequently use a \"destination\" query string parameter in URLs to redirect users to a new destination after completing an action on the current page. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/drupal"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.0.0"
+            },
+            {
+              "fixed": "8.5.8"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/drupal"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.6.0"
+            },
+            {
+              "fixed": "8.6.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-3.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/drupal/drupal"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.drupal.org/sa-core-2018-006"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-601"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-15T20:54:52Z",
+    "nvd_published_at": null
+  }
+}