Mohit Aghera

A missing authorization issue allows forceful browsing and access bypass. The flaw stems from insufficient protection of routes and entity fields, enabling unauthenticated attackers to perform privileged actions, manipulate orders, and access customer payment data or personally identifiable information (PII). This issue affects the shopping cart, checkout, and API functionality. It is estimated that over 42,000 deployments are affected. There are confirmed reports of active exploitation in the wild, including instances of fraudulent orders on live websites.

Incorrect authorization allows forceful browsing due to insufficient verification of administrative privileges when checking access to protected fields. This allows users assigned a role with the machine name `administrator` (provided it is not flagged as the site's actual administrator role) to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields.

Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize attributes used to define custom attributes for a block. This allows an attacker with the `administer blocks` permission to inject malicious scripts into web pages. Cross-site Scripting is a flaw where untrusted data is inserted into a web page without proper validation or encoding, allowing the execution of scripts in the victim's browser.

Incorrect authorization allows forceful browsing. The module enables site builders to control entity page views by showing the page, returning access denied or not found responses, or redirecting visitors. One issue allows anonymous visitors to bypass these behaviors using a specific query parameter, potentially viewing content intended to be hidden or avoiding redirects. Additionally, per-entity settings are stored in fields that lack proper access control; while the module checks permissions to display settings on the edit form, the fields themselves follow default access. This allows users with entity edit permissions to modify these settings if a write path that bypasses the entity form is available, such as REST, JSON:API with writes enabled, or Views Bulk Operations.

An issue exists where the module does not sufficiently sanitize certain attributes, leading to cross-site scripting (XSS), a flaw that allows attackers to inject malicious scripts into web pages. Approximately 15,300 instances have been identified globally. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

An issue exists where the Navigation module does not sufficiently sanitize certain attributes, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

An issue exists in the Drupal core Link module, which provides a field type for internal and external URLs. The module fails to sufficiently sanitize certain markup in specific circumstances, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.

Insufficient permission checks for webform and webform submission entities when retrieving webform elements or fields allow for forceful browsing. This occurs within the module used to retrieve and submit webforms via REST.

Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they are not authorized to view. This issue occurs when a site is configured with a Webform containing a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own submissions or sending uploads as email attachments. Approximately 436,400 instances are identified globally.

The module fails to sufficiently redact the content of logged emails. Consequently, account-related emails are stored with their one-time login links intact. An attacker with the `View Drupal Symfony Mailer log entries` permission can access these links to gain unauthorized access to any account, including the administrative account (user 1). This occurs because the permission was not marked as restricted in earlier releases.

A missing authorization issue in the Image module allows forceful browsing, leading to information disclosure. The module fails to sufficiently check access to image style derivatives when files are served via a file stream other than `private://`. This issue occurs when Drupal is configured to use a contributed file scheme to serve private derived images.

Drupal core contains a gadget chain, which is a sequence of existing code fragments that can be leveraged during the deserialization of untrusted data. While this issue is not directly exploitable, it can serve as a vector to achieve remote code execution or SQL injection if a separate vulnerability allows an attacker to pass unsafe input to the `unserialize()` function.

A flaw exists in Drupal core related to the use of a web browser cache that can contain sensitive information. This is due to incorrectly configured access control security levels.