Kalle Kipinã¤

Insecure storage of sensitive information allows for the retrieval of embedded sensitive data. The module fails to sufficiently encrypt the password of the system user utilized during content synchronization, which may allow unprivileged users to view the password. Exploitation requires the attacker to have prior database read access or a database dump of the user data table.

Improper certificate validation in the Kubernetes and VMware integrations allows an Adversary in the Middle (AiTM) attack. The module fails to properly validate TLS certificates when connecting to remote API endpoints, which may enable an attacker to intercept connections and obtain secret tokens or other credentials, potentially leading to unauthorized access to the connected infrastructure.

Stored Cross-site Scripting (XSS) occurs when the "Allow HTML description" option is enabled. In this configuration, slide descriptions are rendered using the raw stored field value instead of the rendered output, which bypasses Drupal's text format filtering and output sanitization mechanisms. This issue specifically affects sites using a formatted text field as the carousel description source with the mentioned option enabled.

An open redirect issue exists because the module does not sufficiently validate the service URL used to redirect users during the logout process. This allows an attacker to fake the source of data by redirecting users to an untrusted site, provided the user clicks a specially crafted link.