Florent Torregrosa

An authentication bypass exists in the Drupal Internationalization Single Sign-On module. The module fails to sufficiently validate a short-lived token, which allows an attacker to bypass access control and authenticate as a victim user. This issue occurs in multilingual website scenarios where different domain names are used per language to enable automatic connection across domains. Exploitation requires the attacker to appear to originate from the same client IP address as the victim.

An issue exists where the module does not sufficiently sanitize markup passed to components in certain scenarios, leading to Stored Cross-site Scripting (XSS). Cross-site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. Exploitation requires the attacker to have permissions to create or update content rendered by UI Patterns.

An authorization issue exists in Drupal Entity Share that permits forceful browsing. This flaw potentially allows unauthorized access to resources.

The issue is a Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics, allowing unauthorized actions to be performed on behalf of a user.

A Cross-Site Request Forgery (CSRF) issue affects the Drupal Google Tag module, allowing unauthorized actions to be performed on behalf of a user. This issue can be exploited to perform actions without the user's knowledge or consent.