===================================================================== CERT-Renater Note d'Information No. 2021/VULN483 _____________________________________________________________________ DATE : 16/09/2021 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Drupal core versions prior to 9.2.6, 9.1.13, 8.9.19. ===================================================================== https://www.drupal.org/sa-core-2021-006 https://www.drupal.org/sa-core-2021-007 https://www.drupal.org/sa-core-2021-008 https://www.drupal.org/sa-core-2021-009 https://www.drupal.org/sa-core-2021-010 _____________________________________________________________________ Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006 Project: Drupal core Date: 2021-September-15 Security risk: Moderately critical AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13673 Description: The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to cross-site scripting. This advisory is not covered by Drupal Steward . Also see Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028 which addresses a similar vulnerability for that module. Updated 18:15 UTC to clarify text. Solution: Install the latest version: o If you are using Drupal 9.2, update to Drupal 9.2.6 . o If you are using Drupal 9.1, update to Drupal 9.1.13 . o If you are using Drupal 8.9, update to Drupal 8.9.19 . Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core is not affected. Reported By: o Aaron Zinck Fixed By: o Aaron Zinck o Sean Blommaert o Alex Bronstein of the Drupal Security Team o Marcos Cano o Lee Rowlands of the Drupal Security Team o Adam G-H o Jess of the Drupal Security Team o Drew Webber of the Drupal Security Team o Neil Drumm of the Drupal Security Team o Brian Tofte-Schumacher _____________________________________________________________________ Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-007 Project: Drupal core Date: 2021-September-15 Security risk: Moderately critical AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13674 Description: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability. This advisory is not covered by Drupal Steward . Solution: Install the latest version: o If you are using Drupal 9.2, update to Drupal 9.2.6 . o If you are using Drupal 9.1, update to Drupal 9.1.13 . o If you are using Drupal 8.9, update to Drupal 8.9.19 . Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the QuickEdit module and therefore is not affected. Uninstalling the QuickEdit module will also mitigate the vulnerability. Site owners may wish to consider this option as the QuickEdit module will be removed from core in Drupal 10 . Reported By: o Samuel Mortenson Fixed By: o Wim Leers o Greg Knaddison of the Drupal Security Team o Jess of the Drupal Security Team o Lee Rowlands of the Drupal Security Team o Vijay Mani o Heine of the Drupal Security Team o Alex Bronstein of the Drupal Security Team o Adam G-H o Drew Webber of the Drupal Security Team o Theodore Biadala _____________________________________________________________________ Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008 Project: Drupal core Date: 2021-September-15 Security risk: Moderately critical AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass CVE IDs: CVE-2020-13675 Description: Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. This vulnerability is mitigated by three factors: 1. The JSON:API or REST File upload modules must be enabled on the site. 2. An attacker must have access to a file upload via JSON:API or REST. 3. The site must employ a file validation module. This advisory is not covered by Drupal Steward . Also see GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029 which addresses a similar vulnerability for that module. Solution: Install the latest version: o If you are using Drupal 9.2, update to Drupal 9.2.6 . o If you are using Drupal 9.1, update to Drupal 9.1.13 . o If you are using Drupal 8.9, update to Drupal 8.9.19 . Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core is not affected. Reported By: o Klaus Purer Fixed By: o Klaus Purer o Lee Rowlands of the Drupal Security Team o Alex Pott of the Drupal Security Team o Jess of the Drupal Security Team o Samuel Mortenson o Drew Webber of the Drupal Security Team o Kim Pepper _____________________________________________________________________ Drupal core - Moderately critical - Access bypass - SA-CORE-2021-009 Project: Drupal core Date: 2021-September-15 Security risk: Moderately critical AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Access bypass CVE IDs: CVE-2020-13676 Description: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. This advisory is not covered by Drupal Steward . Solution: Install the latest version: o If you are using Drupal 9.2, update to Drupal 9.2.6 . o If you are using Drupal 9.1, update to Drupal 9.1.13 . o If you are using Drupal 8.9, update to Drupal 8.9.19 . Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the QuickEdit module and therefore is not affected. Uninstalling the QuickEdit module will also mitigate the vulnerability. Site owners may wish to consider this option as the QuickEdit module will be removed from core in Drupal 10 . Reported By: o Greg Watson Fixed By: o Greg Watson o Wim Leers o Jess of the Drupal Security Team o Alex Bronstein of the Drupal Security Team o Lee Rowlands of the Drupal Security Team o Joseph Zhao o Vijay Mani o Adam G-H o Drew Webber of the Drupal Security Team _____________________________________________________________________ Drupal core - Moderately critical - Access Bypass - SA-CORE-2021-010 Project: Drupal core Date: 2021-September-15 Security risk: Moderately critical AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Access Bypass CVE IDs: CVE-2020-13677 Description: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected. This advisory is not covered by Drupal Steward . Solution: Install the latest version: o If you are using Drupal 9.2, update to Drupal 9.2.6 . o If you are using Drupal 9.1, update to Drupal 9.1.13 . o If you are using Drupal 8.9, update to Drupal 8.9.19 . Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the JSON:API module and therefore is not affected. Reported By: o Brad Jones Fixed By: o Brad Jones o Jess of the Drupal Security Team o Bjorn Brala o Gabe Sullice o Mateu Aguilo Bosch ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================