Pierre Rudloff

Insufficient input sanitization and output escaping allow users with contributor-level access and above to inject arbitrary web scripts. This occurs because image attribute values are not properly escaped before being processed in the browser, leading to Stored Cross-Site Scripting (XSS), where scripts execute when another user views or previews the affected content.

Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. Files may be served with the `Cache-Control: public` HTTP header when they should be uncacheable, potentially allowing users to access cached versions of files containing information they are not authorized to see. This occurs when a more-privileged user has previously requested the file and it remains in the cache.

A security issue exists in the Drupal CacheFlush project. The project is currently marked as unsupported, and the issue remains unresolved by the maintainer.

This module provides a framework for integrating AI providers and features into Drupal. The issue occurs because the module does not sufficiently sanitize certain HTMX attributes, leading to Cross-Site Scripting (XSS), where malicious scripts can be injected into web pages.

An authentication bypass issue exists where the module fails to fully invalidate a solved CAPTCHA session. This allows a protected form that has been submitted once to be submitted again without solving a new challenge. This flaw weakens protection against automated submissions, including login brute-forcing, comment spam, and spam registrations.

Insufficient input sanitization and output escaping allow authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks. This occurs because the plugin fails to prevent animation elements in uploaded SVG files from changing a link's target to a `javascript:` URI, bypassing sanitization. The injected arbitrary web scripts execute in WebKit-based browsers, such as Safari, whenever a user accesses the affected page.

A missing authorization issue allows forceful browsing. The module fails to sufficiently verify access to image style derivatives when these files are served through a file stream other than `private://`. This issue is mitigated if Drupal is configured to use a contributed file scheme to serve private derived images.

Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. The module serves WebP image derivative responses with the `Cache-Control: public` HTTP header for all file schemes except the private file system, including temporary file systems and access-controlled custom schemes. This behavior can result in users receiving cached versions of files containing information they are not authorized to access, particularly when using a shared cache like Varnish or a CDN that honors the `Cache-Control` header. Exploitation requires the site to serve image derivatives from a custom or temporary file scheme with access control behind such a cache, and the attacker must know the path of a previously requested file remaining in the cache.

Drupal Shield fails to sufficiently limit the number of authentication attempts when an anonymous visitor repeatedly submits basic authentication credentials. This allows for brute force attacks against the HTTP basic authentication prompt used to protect non-public sites from being viewed, crawled, or indexed. The risk is reduced if long, randomly generated passwords are used.

An incorrect authorization issue in the Dopup module, which manages Webforms, allows forceful browsing. The module fails to perform sufficient entity access checking in certain instances, potentially exposing the titles of private Webforms.

Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. The module enables direct viewing of files via URL aliases, but some files may be served with the `Cache-Control: public` HTTP header when they should be uncacheable. This allows users to access cached versions of files containing information they are not authorized to see. Exploitation requires an attacker to request a file previously accessed by a more-privileged user while that file remains in the cache.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify role delegation during the user approval process and provides an Activate link for blocked administrators. Additionally, it does not prevent the deactivation or deletion of user 1. Exploitation requires the attacker to possess a role with one of the module's additional action permissions.

An Unsafe Reflection issue exists where externally-controlled input can be used to select classes or code, leading to Reflection Injection. This flaw allows for remote code execution. While the issue is not directly exploitable using the module in isolation, multiple serious exploit paths exist when combined with other contributed modules, including at least one path that does not require authentication. Custom code may also expose this functionality.

An issue exists where the Navigation module does not sufficiently sanitize certain attributes, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

A remote code execution issue exists within the Field UI module (`field ui`) in Drupal core. While the issue is not directly exploitable using core functionality alone, multiple serious exploit paths are available through the use of contributed modules or custom code. At least one known exploit path allows for unauthenticated remote code execution. Approximately 151,000 sites are potentially affected due to the use of outdated CMS branches. This flaw can be used to achieve lateral movement from compromised web servers into internal infrastructure.

An improper check for unusual or exceptional conditions allows forceful browsing. The issue occurs when the module is in Permission mode and a node referencing a deleted taxonomy term is accessed via the JSON:API. This requires a specific module configuration and the presence of references to a deleted term to be exploited.

The Webform module fails to sufficiently sanitize attributes used by its color element. This can lead to cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, when the element is rendered. Exploitation requires the attacker to add a specially crafted link with a specific class to the same page as the affected webform. Approximately 436,400 instances of Drupal were identified globally as potential targets.

An issue exists in the Webform module, which is used to create forms and collect submissions. Due to improper sanitization of announcement text used for assistive technologies, specially crafted input can lead to cross-site scripting. Approximately 436,400 instances of Drupal were identified globally as potentially exposed. Remote code execution is also possible.

The Webform module contains a rating element that does not sufficiently validate data. This flaw could allow cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, on pages containing a rating element. Exploitation requires the attacker to be able to place crafted HTML markup on the same page as the rating element. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

The Webform module fails to sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. This flaw allows markup from counter-related settings to be inserted into the page, resulting in cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. Exploitation requires the attacker to have permissions to create or edit affected Webform elements or to place crafted counter markup on a page where the Webform counter JavaScript is active. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.