Neil Drumm

An incorrect authorization issue allows forceful browsing when Drupal Commerce is used in conjunction with the JSON:API module. This allows users without proper permissions to access unpublished product variations. This issue specifically affects sites that maintain both published products and unpublished product variations.

Incorrectly configured access control security levels allow the caching of token permissions in a manner that enables them to be reused for another user's token sharing the same scopes. This can lead to a user gaining unauthorized permissions, including administrative access. Exploitation requires a more privileged user's token with identical scopes to be used first.

An issue exists in the Drupal core Link module, which provides a field type for internal and external URLs. The module fails to sufficiently sanitize certain markup in specific circumstances, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.

Insufficient sanitization of tooltips and help text within the Webform module allows for cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess permissions to create or edit the affected Webform configuration or content. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

The Webform module contains a rating element that does not sufficiently validate data. This flaw could allow cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, on pages containing a rating element. Exploitation requires the attacker to be able to place crafted HTML markup on the same page as the rating element. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

An incorrect authorization issue allows forceful browsing. The module, which manages permissions per node content type to control access to unpublished content, incorrectly allows view access for published content, overriding other existing access mechanisms.

A missing authorization issue allows forceful browsing. The module fails to sufficiently verify block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This allows an unauthenticated attacker to retrieve restricted block content, provided they can identify the machine ID of a block containing sensitive information protected by visibility restrictions.

An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the integrity of data returned by the payment provider, which could enable an attacker to use a timing attack to trick the site into registering a payment as received when it has not been.

Improper neutralization of input during web page generation in the Slick UI sub-module allows for Stored Cross-site Scripting (XSS). The issue occurs because the module does not sufficiently validate user input within Slick option sets that contain HTML for carousel buttons.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the Payflow Link payment gateway, which enables a malicious user to mark transactions as completed without providing payment.

An incorrect authorization issue allows forceful browsing. The module fails to correctly enforce access when rendering node and block tabs by treating neutral access results as grants for node tabs and block plugins. Additionally, no access check is performed for reusable custom blocks. This allows users without proper permissions to view restricted content, such as unpublished nodes or unpublished reusable custom blocks. The risk is limited because the content exposed is pre-selected by a user with the `administer quicktabs` permission during configuration.

Improper handling of case sensitivity allows privilege escalation. The module fails to ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under specific database collation configurations. This issue primarily affects sites using certain MySQL or MariaDB collation settings for the authentication mapping storage.

Insufficient validation of certain inputs allows an attacker to perform Server-Side Request Forgery (SSRF), a technique where the server is coerced into making unauthorized requests to internal or external resources.

An incorrect authorization issue allows forceful browsing when editing entities. The module fails to sufficiently verify access rights, enabling a malicious user to craft requests to modify any field on any entity. This issue is mitigated if the attacker lacks the "edit in place field editing permission" role.

A security issue exists in the Disable Login Page project. The project is currently marked as unsupported, and the maintainer has not provided a fix for this issue.

A missing authorization issue allows forceful browsing when viewing images using the photoswipe image gallery display formatter. The module fails to sufficiently check access permissions, which may allow unauthorized users to view images that should be restricted.

An issue exists where the module does not sufficiently sanitize markup passed to components in certain scenarios, leading to Stored Cross-site Scripting (XSS). Cross-site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. Exploitation requires the attacker to have permissions to create or update content rendered by UI Patterns.

Improperly controlled modification of dynamically-determined object attributes allows Object Injection. Additionally, the Render submodule fails to sufficiently sanitize template code when rendering inline Twig templates as part of no-code models, which can lead to information disclosure. This issue is mitigated if the site is not running an ECA model that utilizes the "Render: Twig" action on a data flow.

A missing authorization issue allows forceful browsing. The module, which enables testing and running AI-driven workflows via a chat interface, fails to sufficiently enforce permissions on certain endpoints. This may allow attackers to trigger workflow execution, resulting in LLM (Large Language Model) costs and tool side effects, or enable them to send messages into sessions belonging to other users. This issue is mitigated if the attacker does not possess the "View any session" permission, which is not granted to anonymous or authenticated users by default.

A missing authorization issue allows forceful browsing. The module, which enables testing and running AI-driven workflows via a chat interface, fails to sufficiently re-evaluate human-in-the-loop approval gates during workflow iterations that occur more than once. This can lead to the execution of workflows not intended by the user. Exploitation requires the attacker to possess the "Administer FlowDrop workflows" role or equivalent permissions such as "Create FlowDrop workflows" or "Edit FlowDrop workflows".