Marcus Johansson

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Two distinct issues were identified. First, a module designed to restrict access to the `/user/login` endpoint via a secret key fails to invalidate relevant caches upon activation. This allows attackers to access the login page through cached responses. Second, a module that exposes structured data via JSON endpoints does not sufficiently verify access permissions. This allows anonymous users to retrieve field values from entities they are not authorized to view, such as unpublished content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal LDAP / Active Directory Integration versions 0.0.0 through 2.2.1 **Description** An LDAP Injection issue exists because the module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover information that should not normally be accessible. **Recommendations** Update Drupal LDAP / Active Directory Integration to a version newer than 2.2.1.

**Name of the Vulnerable Software and Affected Versions** Drupal Digital Signage Framework versions 0.0.0 through 2.6.1 **Description** A missing authorization issue allows forceful browsing. The module provides a route for signage devices to refresh dynamic blocks on a display, but it fails to verify if the requester is an authorized signage device or if the requested block is intended for display. Consequently, an anonymous visitor can read the rendered content of blocks they are not authorized to see. This is partially mitigated if block plugins perform their own access checks on the content. **Recommendations** Update Drupal Digital Signage Framework to a version later than 2.6.1.

**Name of the Vulnerable Software and Affected Versions** Entity PDF versions 0.0.0 through 2.1.5 **Description** Missing authorization in the Entity PDF module allows forceful browsing. The module fails to check entity view access when fetching a PDF route, which may allow a user to access a PDF of an entity they are not authorized to view. **Recommendations** Update Entity PDF to a version later than 2.1.5.

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Share Websub versions 0.0.0 through 1.1.2 **Description** Insufficient validation of certain inputs allows an attacker to perform Server-Side Request Forgery (SSRF), a technique where the server is coerced into making unauthorized requests to internal or external resources. **Recommendations** Update Drupal Entity Share Websub to a version later than 1.1.2.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.2.17 Drupal AI versions 1.3.0 through 1.3.8 Drupal AI versions 1.4.0 through 1.4.3 **Description** A missing authorization issue allows forceful browsing. Certain Drupal core actions exposed as agent tools lack correct access validation, and some core actions are missing associated access-level definitions. This allows an agent to utilize Drupal core actions tools by bypassing access controls, provided the attacker can communicate with the affected agent and the site is configured to expose these tools to non-privileged users. **Recommendations** Update Drupal AI versions 0.0.0 through 1.2.17 to a version newer than 1.2.17. Update Drupal AI versions 1.3.0 through 1.3.8 to a version newer than 1.3.8. Update Drupal AI versions 1.4.0 through 1.4.3 to a version newer than 1.4.3.

**Name of the Vulnerable Software and Affected Versions** Drupal OpenAI Provider versions 0.0.0 through 1.1.1 Drupal OpenAI Provider versions 1.2.0 through 1.2.2 **Description** Insufficient sanitization of user-supplied URLs leads to a Server-Side Request Forgery (SSRF), a flaw where an attacker can induce the server to make requests to an unintended location. Exploitation requires the attacker to have permissions to modify the host URL and the ability to generate AI-generated images. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.2.17 Drupal AI versions 1.3.0 through 1.3.8 Drupal AI versions 1.4.0 through 1.4.3 **Description** Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module and specific submodules, including AI Automators, AI Translate, AI API Explorer, and AI Content Suggestions, enable the use of a Large Language Model (LLM) to generate HTML or Markdown for browser preview. Under certain conditions, rendering this HTML can lead to XSS or the exposure of secret communications within the context of the LLM request. This issue requires an attacker to be able to inject text into prompts to execute the attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal AI Agents versions 0.0.0 through 1.1.4 Drupal AI Agents versions 1.2.0 through 1.2.5 Drupal AI Agents versions 1.3.0 through 1.3.1 **Description** Missing authorization allows forceful browsing within the module that provides the entity type and runtime for agents to use tools. The issue occurs because the module does not sufficiently check required permissions when a tool loads content entities. Exploitation requires that an agent be configured to use the affected tool and that the attacker has access to that agent. **Recommendations** Update Drupal AI Agents versions 0.0.0 through 1.1.4 to a version newer than 1.1.4. Update Drupal AI Agents versions 1.2.0 through 1.2.5 to a version newer than 1.2.5. Update Drupal AI Agents versions 1.3.0 through 1.3.1 to a version newer than 1.3.1.

**Name of the Vulnerable Software and Affected Versions** Drupal AI Agents versions 0.0.0 through 1.1.4 Drupal AI Agents versions 1.2.0 through 1.2.5 Drupal AI Agents versions 1.3.0 through 1.3.1 **Description** An incorrect authorization issue allows forceful browsing. Under certain conditions, the agent inherits deterministic parameters when invoking the same tool within a single request, which may result in information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.1.10 Drupal AI versions 1.2.0 through 1.2.11 **Description** An incorrect authorization issue exists in Drupal AI (Artificial Intelligence) that allows for resource injection. The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) allow the use of a Large Language Model (LLM) to generate HTML or Markdown, and preview it in a browser. Under specific conditions, rendering this HTML can expose secret communications related to the LLM request. **Recommendations** Update Drupal AI to version 1.1.11 or later. Update Drupal AI to version 1.2.12 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.0.6 Drupal AI versions 1.1.0 through 1.1.6 Drupal AI versions 1.2.0 through 1.2.3 **Description** A flaw exists in Drupal AI that allows for Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability could potentially allow an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update Drupal AI to version 1.0.7 or later. Update Drupal AI to version 1.1.7 or later. Update Drupal AI to version 1.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal AI (Artificial Intelligence) versions 0.0.0 through 1.0.4 **Description** The issue is related to an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. This allows for OS Command Injection. **Recommendations** For versions 0.0.0 through 1.0.4, update to version 1.0.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal AI (Artificial Intelligence) versions 0.0.0 through 1.0.4 **Description** The issue is related to an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. This allows for OS Command Injection. **Recommendations** For versions 0.0.0 through 1.0.4, update to version 1.0.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal AI (Artificial Intelligence) versions 0.0.0 through 1.0.2 **Description** The issue is related to a Missing Authorization vulnerability, which allows Forceful Browsing in Drupal AI (Artificial Intelligence). **Recommendations** For versions 0.0.0 through 1.0.2, update to version 1.0.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal AI (Artificial Intelligence) versions 1.0.0 through 1.0.1 **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform actions on a user's behalf without their consent. This is a type of attack where an attacker tricks a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For versions 1.0.0 through 1.0.1, update to version 1.0.2 or later to resolve the issue.