最新のセキュリティ情報
2 ページ目
7月21日(木)
Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2022-014
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Critical 15 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Arbitrary PHP code execution Affected versions: >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25277 Description: Updated 2022-07-20 19:45 UTC to indicate that this only affects Apache web servers. Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012 ) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-…
Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access Bypass Affected versions: >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25278 Description: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes…
Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information Disclosure Affected versions: >=7.0 <7.91 || >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25275 Description: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file syst…
6月11日(土)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-011
Project: Drupal core Project machine name: drupal Date: 2022-June-10 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.21 || >= 9.3.0 <9.3.16 CVE IDs: CVE-2022-31042 CVE-2022-31043 Description: Updated 22:00 UTC 2022-06-10: Added steps to update without drupal/core-recommended . Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released two security advisories: Failure to strip the Cookie header on change…
5月26日(木)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-010
Project: Drupal core Project machine name: drupal Date: 2022-May-25 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.20 || >= 9.3.0 <9.3.14 CVE IDs: CVE-2022-29248 Description: Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which does not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites. We are issuing this security advisory outside…
4月21日(木)
Drupal core - Moderately critical - Access bypass - SA-CORE-2022-009
Project: Drupal core Project machine name: drupal Date: 2022-April-20 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: >= 9.3.0 <9.3.12 CVE IDs: CVE-2022-25274 Description: Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content.…
Drupal core - Moderately critical - Improper input validation - SA-CORE-2022-008
Project: Drupal core Project machine name: drupal Date: 2022-April-20 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Improper input validation Affected versions: >= 8.0.0 <9.2.18 || >= 9.3.0 <9.3.12 CVE IDs: CVE-2022-25273 Description: Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter cr…
3月22日(火)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-006
Project: Drupal core Project machine name: drupal Date: 2022-March-21 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.16 || >= 9.3.0 <9.3.9 CVE IDs: CVE-2022-24775 Description: Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which may affect some Drupal sites. We are issuing this security advisory outside our regular Drupal security release window schedule since Guzzle has alr…
3月17日(木)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-005
Project: Drupal core Project machine name: drupal Date: 2022-March-16 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.15 || >= 9.3.0 <9.3.8 CVE IDs: CVE-2022-24728 CVE-2022-24729 Description: The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal . Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (e…
2月17日(木)
Drupal core - Moderately critical - Information disclosure - SA-CORE-2022-004
Project: Drupal core Project machine name: drupal Date: 2022-February-16 Security risk: Moderately critical 12 ∕ 25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Information disclosure Affected versions: >= 8.0.0 <9.2.13 || >= 9.3.0 <9.3.6 CVE IDs: CVE-2022-25270 Description: The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard pr…