Jimmy Henderickx

**Name of the Vulnerable Software and Affected Versions** Drupal Facets versions 0.0.0 through 2.0.9 Drupal Facets versions 3.0.0 through 3.0.0 **Description** A missing authorization issue exists in Drupal Facets, potentially allowing forceful browsing. The issue relates to insufficient access controls. **Recommendations** Update Drupal Facets to version 2.0.10 or later. Update Drupal Facets to version 3.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Facets versions 0.0.0 through 2.0.9 **Description** The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting (XSS). This can be exploited by a remote attacker to hijack a user's session. The problem is associated with the two-factor authentication module and incorrect session management. **Recommendations** For versions 0.0.0 through 2.0.9, update to a version later than 2.0.9 to resolve the issue. As a temporary workaround, consider restricting access to the Facets module to minimize the risk of exploitation. Avoid using the Facets module until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 7.x before 7.43 Drupal versions 8.x before 8.0.4 **Description** The issue allows remote attackers to obtain sensitive username information. This is possible by leveraging a configuration that permits using an email address to login and a module that permits logging in. **Recommendations** For Drupal 7.x, update to version 7.43 or later. For Drupal 8.x, update to version 8.0.4 or later.