Lee Rowlands

A missing authorization issue allows forceful browsing and access bypass. The flaw stems from insufficient protection of routes and entity fields, enabling unauthenticated attackers to perform privileged actions, manipulate orders, and access customer payment data or personally identifiable information (PII). This issue affects the shopping cart, checkout, and API functionality. It is estimated that over 42,000 deployments are affected. There are confirmed reports of active exploitation in the wild, including instances of fraudulent orders on live websites.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently restrict access to fields configured as Private on entity types that lack an author field (such as a user account or owner). Consequently, these Private fields can be viewed, and if the entity is editable, it can be modified by any user who can view it, including anonymous users. This issue does not affect fields set to Private on nodes, users, media, comments, or other entity types with an author, nor does it affect fields using Custom permissions.

Single Content Sync allows exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution via Object Injection. This issue requires the attacker to possess a role with the "import single content" permission.

Incorrect authorization allows forceful browsing due to insufficient verification of administrative privileges when checking access to protected fields. This allows users assigned a role with the machine name `administrator` (provided it is not flagged as the site's actual administrator role) to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields.

Stored Cross-site Scripting (XSS) occurs because twig templates do not sufficiently sanitize values passed to its markup. This issue requires the attacker to possess a role that allows editing content using the paragraph bundles provided by the module.

An issue exists in the Drupal core Link module, which provides a field type for internal and external URLs. The module fails to sufficiently sanitize certain markup in specific circumstances, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.

An Unsafe Reflection issue exists where externally-controlled input can be used to select classes or code, leading to Reflection Injection. This flaw allows for remote code execution. While the issue is not directly exploitable using the module in isolation, multiple serious exploit paths exist when combined with other contributed modules, including at least one path that does not require authentication. Custom code may also expose this functionality.

An issue exists where the Navigation module does not sufficiently sanitize certain attributes, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

A remote code execution issue exists within the Field UI module (`field ui`) in Drupal core. While the issue is not directly exploitable using core functionality alone, multiple serious exploit paths are available through the use of contributed modules or custom code. At least one known exploit path allows for unauthenticated remote code execution. Approximately 151,000 sites are potentially affected due to the use of outdated CMS branches. This flaw can be used to achieve lateral movement from compromised web servers into internal infrastructure.

An issue exists where user-specific access rules are not sufficiently guarded against malformed saved configurations. Under specific site conditions, an access rule designed to restrict submission access to selected user accounts may inadvertently grant access to anonymous users. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

Stored Cross-Site Scripting (XSS) occurs when the module does not sufficiently restrict access to raw webform source editing while the Webform UI module is disabled. This allows a user with permissions to create or edit webforms to input source configuration that is rendered unsafely. Stored XSS is a security flaw where a malicious script is permanently stored on the target server and executed in the browser of users who view the affected page.

The Webform module contains a rating element that does not sufficiently validate data. This flaw could allow cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, on pages containing a rating element. Exploitation requires the attacker to be able to place crafted HTML markup on the same page as the rating element. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

The Webform module, used for creating forms and processing submissions, contains a flaw in how it handles Remote Post handlers. These handlers send data to external servers via APIs. The module fails to sufficiently filter response values from the Remote Post handler before they are rendered through handler response tokens. Consequently, if a site uses these tokens in rendered output, a remote endpoint could return values that are rendered as HTML, leading to cross-site scripting (XSS), where malicious scripts are injected into trusted websites. Approximately 436,300 instances were identified globally.

The Webform module fails to sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. This flaw allows markup from counter-related settings to be inserted into the page, resulting in cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. Exploitation requires the attacker to have permissions to create or edit affected Webform elements or to place crafted counter markup on a page where the Webform counter JavaScript is active. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

The Webform module fails to properly force the download of certain uploaded file types when they are served. In specific site configurations, a file uploaded via a webform can be rendered inline by a browser, leading to cross-site scripting (XSS), where malicious scripts are executed in the victim's browser. Approximately 436,300 instances were identified globally. This issue requires a user with permissions to create or edit webforms to allow the affected file extensions, and a victim must manually open the uploaded file.

The Webform module fails to sufficiently sanitize attributes used by its color element. This can lead to cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, when the element is rendered. Exploitation requires the attacker to add a specially crafted link with a specific class to the same page as the affected webform. Approximately 436,400 instances of Drupal were identified globally as potential targets.

An issue exists in the Webform module, which is used to create forms and collect submissions. Due to improper sanitization of announcement text used for assistive technologies, specially crafted input can lead to cross-site scripting. Approximately 436,400 instances of Drupal were identified globally as potentially exposed. Remote code execution is also possible.

Insufficient sanitization of tooltips and help text within the Webform module allows for cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess permissions to create or edit the affected Webform configuration or content. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

When the Webform module is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. This occurs when a webform is configured to allow authenticated users to view their own submissions, potentially causing a request to the JSON:API webform submission collection endpoint to return a cached response generated for a different user. Consequently, an authenticated user may view another user's webform submission data. Approximately 436,300 instances of Drupal were identified globally as potentially exposed. This issue requires JSON:API to be enabled, the affected webform to expose submissions through JSON:API, and the attacker to possess an account with permissions to view their own submissions.

Insufficient granularity of access control in the Webform module allows forceful browsing. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers, which could allow a user with permission to edit a webform to configure a remote HTTP operation.