Florent Torregrosa

**Name of the Vulnerable Software and Affected Versions** Drupal Internationalization Single Sign-On versions 0.0.0 through 1.8.0 **Description** An authentication bypass exists in the Drupal Internationalization Single Sign-On module. The module fails to sufficiently validate a short-lived token, which allows an attacker to bypass access control and authenticate as a victim user. This issue occurs in multilingual website scenarios where different domain names are used per language to enable automatic connection across domains. Exploitation requires the attacker to appear to originate from the same client IP address as the victim. **Recommendations** Update Drupal Internationalization Single Sign-On to a version later than 1.8.0.

**Name of the Vulnerable Software and Affected Versions** Drupal UI Patterns (SDC in Drupal UI) versions 2.0.0 through 2.0.17 **Description** An issue exists where the module does not sufficiently sanitize markup passed to components in certain scenarios, leading to Stored Cross-site Scripting (XSS). Cross-site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. Exploitation requires the attacker to have permissions to create or update content rendered by UI Patterns. **Recommendations** Update Drupal UI Patterns (SDC in Drupal UI) to a version later than 2.0.17.

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Share versions prior to 3.13.0 **Description** An authorization issue exists in Drupal Entity Share that permits forceful browsing. This flaw potentially allows unauthorized access to resources. **Recommendations** Update Drupal Entity Share to version 3.13.0 or later.

**Name of the Vulnerable Software and Affected Versions** Matomo Analytics versions 0.0.0 through 1.23.0 **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics, allowing unauthorized actions to be performed on behalf of a user. **Recommendations** For versions 0.0.0 through 1.23.0, update to version 1.24.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal Google Tag versions 0.0.0 through 1.7.x Drupal Google Tag versions 2.0.0 through 2.0.7 **Description** A Cross-Site Request Forgery (CSRF) issue affects the Drupal Google Tag module, allowing unauthorized actions to be performed on behalf of a user. This issue can be exploited to perform actions without the user's knowledge or consent. **Recommendations** For versions 0.0.0 through 1.7.x, update to version 1.8.0 or later. For versions 2.0.0 through 2.0.7, update to version 2.0.8 or later.