最新のセキュリティ情報
10月21日(水)昨日
Weekly Report: Drupal coreおよび複数のモジュールに脆弱性
Drupal coreおよび複数のモジュールに脆弱性
10月15日(木)
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108514 Description: The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to e…
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108515 Description: The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities…
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default Vulnerability: Remote code execution Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108097 Description: A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit p…
9月17日(木)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013
Project: Drupal core Project machine name: drupal Date: 2026-September-16 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >=10.5.0 <10.6.17 || >=11.0.0 <11.3.17 || >=11.4.0 <11.4.7 Description: The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal . Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor th…
7月16日(木)
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
Project: Drupal core Project machine name: drupal Date: 2026-July-15 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.* CVE IDs: CVE-2026-55805 Description: The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Bu…
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
Project: Drupal core Project machine name: drupal Date: 2026-July-15 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.2.* CVE IDs: CVE-2026-15917 Description: Drupal core 11.2 and above integrate the HTMX JavaScript library. Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML wi…
Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
Project: Drupal core Project machine name: drupal Date: 2026-July-15 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.* CVE IDs: CVE-2026-15916 Description: The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private:// . This vulnerability is mitigated by the fact t…
6月18日(木)
Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Improper validation Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55808 Description: The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.…
Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Server-side request forgery Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55807 Description: The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side request…
Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Less critical 9 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default Vulnerability: Cache poisoning and open redirect Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55806 Description: Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition. This script doesn't correctly check the Host header against…
Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55804 Description: Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execut…
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Critical 18 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: PHP object injection Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55803 Description: SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially…
5月21日(木)
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Project: Drupal core Project machine name: drupal Date: 2026-May-20 Security risk: Highly critical 23 ∕ 25 AC:None/A:None/CI:All/II:All/E:Exploit/TD:Uncommon Vulnerability: SQL injection Affected versions: >= 8.9.0 < 10.4.10 || >= 10.5.0 < 10.5.10 || >= 10.6.0 < 10.6.9 || >= 11.0.0 < 11.1.10 || >= 11.2.0 < 11.2.12 || >= 11.3.0 < 11.3.10 CVE IDs: CVE-2026-9082 Description: Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted re…
4月16日(木)
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Project: Drupal core Project machine name: drupal Date: 2026-April-15 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6367 Description: Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5. The suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user. Solution: Install the latest version: If you use Drupal 11.3.x, update to Drup…
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
Project: Drupal core Project machine name: drupal Date: 2026-April-15 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget Chain Affected versions: >= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6366 Description: Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or…
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Project: Drupal core Project machine name: drupal Date: 2026-April-15 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: >= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6365 Description: Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to a cross-site scripting (XSS) vulnerability. Solution: Install the latest version: If you use Drupal 10.5.x, update to Drupal 10.5.9 . If yo…
11月13日(木)
Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008
Project: Drupal core Project machine name: drupal Date: 2025-November-12 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13083 Description: The core system module handles downloads of private and temporary files. Contrib modules can define additional kinds of files (schemes) that may also be handled by the system module. In some cases, files may be served with the HTTP header Cache-…
Drupal core - Moderately critical - Defacement - SA-CORE-2025-007
Project: Drupal core Project machine name: drupal Date: 2025-November-12 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All Vulnerability: Defacement Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13082 Description: By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement. The defacement is not stored and is only present when the URL has been crafted for that purpose. Only the defacement is present, so no other site content (suc…
Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006
Project: Drupal core Project machine name: drupal Date: 2025-November-12 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13081 Description: Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution if the…
Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005
Project: Drupal core Project machine name: drupal Date: 2025-November-12 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Denial of Service Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13080 Description: Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden. This functionality can be abused in a way that may cause Drupal to cache response data that it should not.…
3月20日(木)
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
Project: Drupal core Project machine name: drupal Date: 2025-March-19 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: >= 8.0.0 < 10.3.14 || >= 10.4.0 < 10.4.5 || >= 11.0.0 < 11.0.13 || >= 11.1.0 < 11.1.5 CVE IDs: CVE-2025-31675 Description: Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability (XSS). This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to…
2月20日(木)
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003
Project: Drupal core Project machine name: drupal Date: 2025-February-19 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget Chain Affected versions: >= 8.0.0 < 10.3.13 || >= 10.4.0 < 10.4.3 || >= 11.0.0 < 11.0.12 || >= 11.1.0 < 11.1.3 CVE IDs: CVE-2025-31674 Description: Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Arbitrary File Inclusion. Techniques exist to escalate this attack to Remote Code Execution. It is not directly exploitable. This is…
Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002
Project: Drupal core Project machine name: drupal Date: 2025-February-19 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: >= 8.0.0 < 10.3.13 || >= 10.4.0 < 10.4.3 || >= 11.0.0 < 11.0.12 || >= 11.1.0 < 11.1.3 CVE IDs: CVE-2025-31673 Description: Bulk operations allow authorized users to modify several nodes at once from the Content page ( /admin/content ). A site builder can also add bulk operations to other pages using Views. A bug in the core Actions system allows some users to modify some fiel…
Drupal core - Critical - Cross site scripting - SA-CORE-2025-001
Project: Drupal core Project machine name: drupal Date: 2025-February-19 Security risk: Critical 17 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Proof/TD:All Vulnerability: Cross site scripting Affected versions: >= 8.0.0 < 10.3.13 || >= 10.4.0 < 10.4.3 || >= 11.0.0 < 11.0.12 || >= 11.1.0 < 11.1.3 CVE IDs: CVE-2025-3057 Description: Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability (XSS). Sites are encouraged to update. There are not yet public documented steps to exploit this, but there may be soon given th…
11月21日(木)
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008
Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: >=7.0 < 7.102 || >= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 CVE IDs: CVE-2024-55638 Description: Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable. This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must…
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: >= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8 CVE IDs: CVE-2024-55637 Description: Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable. This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability…
Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Less critical 8 ∕ 25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: >= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8 CVE IDs: CVE-2024-55636 Description: Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Artbitrary File Deletion. It is not directly exploitable. This issue is mitigated by the fact that in order to be exploitable, a separate vulnerability must be p…
Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005
Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Critical 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: >=7.0 <7.102 CVE IDs: CVE-2024-55635 Description: Drupal 7 core's Overlay module doesn't safely handle user input, leading to reflected cross-site scripting under certain circumstances. Only sites with the Overlay module enabled are affected by this vulnerability. Solution: Install the latest version: If you are using Drupal 7, update to Drupal 7.102 Sites may also disable the Ove…
Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004
Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: >= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8 CVE IDs: CVE-2024-55634 Description: Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. Solution: Install the latest…
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003
Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: >= 8.8.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8 CVE IDs: CVE-2024-12393 Description: Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. Solution: Install the latest version: If you are using Drupal 10.2, update to Drupal 10.2.11. If you are using Drup…
10月17日(木)
Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
Project: Drupal core Project machine name: drupal Date: 2024-October-16 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:All/E:Theoretical/TD:Uncommon Vulnerability: Improper error handling Affected versions: >=10.0 < 10.2.10 CVE IDs: CVE-2024-11942 Description: Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site. The issue is mitigated by the fact that several non-default site configurat…
1月18日(木)
Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
Project: Drupal core Project machine name: drupal Date: 2024-January-17 Security risk: Moderately critical 11 ∕ 25 AC:None/A:None/CI:None/II:None/E:Theoretical/TD:Default Vulnerability: Denial of Service Affected versions: >=8.0 <10.1.8 || >=10.2 <10.2.2 CVE IDs: CVE-2024-11941 Description: The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS). Sites that do not use the Comment module are not affected. Solution: Install the latest version: If you are using Drupal 10.2, update to Drupal…
9月21日(木)
Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
Project: Drupal core Project machine name: drupal Date: 2023-September-20 Security risk: Critical 16 ∕ 25 AC:Complex/A:None/CI:All/II:Some/E:Theoretical/TD:Default Vulnerability: Cache poisoning Affected versions: >=8.7.0 <9.5.11 || >=10.0 <10.0.11 || >= 10.1 <10.1.4 CVE IDs: CVE-2023-5256 Description: In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled…
4月20日(木)
Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005
Project: Drupal core Project machine name: drupal Date: 2023-April-19 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <7.96.0 || >=9.4.0 <9.4.14 || >=9.5.0 <9.5.8 || >=10.0.0 <10.0.8 || 8.0.* || 8.1.* || 8.2.* || 8.3.* || 8.4.* || 8.5.* || 8.6.* || 8.7.* || 8.8.* || 8.9.* || 9.0.* || 9.1.* || 9.2.* || 9.3.* CVE IDs: CVE-2023-31250 Description: The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they…
3月16日(木)
Drupal core - Moderately critical - Access bypass - SA-CORE-2023-004
Project: Drupal core Project machine name: drupal Date: 2023-March-15 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <7.95 || >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5 Description: Drupal core provides a page that outputs the markup from phpinfo() to assist with diagnosing PHP configuration. If an attacker was able to achieve an XSS exploit against a privileged user, they may be able to use the phpinfo page to access sensitive information that could be used to escalate the attack…
Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-003
Project: Drupal core Project machine name: drupal Date: 2023-March-15 Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information Disclosure Affected versions: >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5 Description: The language module provides a Language switcher block which can be placed to provide links to quickly switch between different languages. The URL of unpublished translations may be disclosed. When used in conjunction with a module like Pathauto, this may reveal the title of unpublished content. This adv…
Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-002
Project: Drupal core Project machine name: drupal Date: 2023-March-15 Security risk: Moderately critical 14 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Information Disclosure Affected versions: >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5 Description: The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files. This release was coordinated with SA-CONTRIB-2023-010 . This advisory is not covered by Drupal Steward . Solution…
1月19日(木)
Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-001
Project: Drupal core Project machine name: drupal Date: 2023-January-18 Security risk: Moderately critical 12 ∕ 25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Information Disclosure Affected versions: >=8.0.0 <9.4.10 || >=9.5.0 <9.5.2 || >=10.0.0 <10.0.2 Description: The Media Library module does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about media items they are not authorized to access. The vulnerability is mitigated by the fact that the inaccessible media will only be visible to u…
9月29日(木)
Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2022-016
Project: Drupal core Project machine name: drupal Date: 2022-September-28 Security risk: Critical 18 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Proof/TD:All Vulnerability: Multiple vulnerabilities Affected versions: >= 8.0.0 <9.3.22 || >= 9.4.0 <9.4.7 CVE IDs: CVE-2022-39261 Description: Drupal uses the Twig third-party library for content templating and sanitization. Twig has released a security update that affects Drupal. Twig has rated the vulnerability as high severity. Drupal core's code extending Twig has also been updated to mitigate a related vulnerability. Multiple vulnerabilities are pos…
7月21日(木)
Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2022-015
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Multiple vulnerabilities Affected versions: >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25276 Description: The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities. This advisory is not cove…
Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2022-014
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Critical 15 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Arbitrary PHP code execution Affected versions: >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25277 Description: Updated 2022-07-20 19:45 UTC to indicate that this only affects Apache web servers. Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012 ) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-…
Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access Bypass Affected versions: >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25278 Description: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes…
Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information Disclosure Affected versions: >=7.0 <7.91 || >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25275 Description: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file syst…
6月11日(土)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-011
Project: Drupal core Project machine name: drupal Date: 2022-June-10 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.21 || >= 9.3.0 <9.3.16 CVE IDs: CVE-2022-31042 CVE-2022-31043 Description: Updated 22:00 UTC 2022-06-10: Added steps to update without drupal/core-recommended . Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released two security advisories: Failure to strip the Cookie header on change…
5月26日(木)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-010
Project: Drupal core Project machine name: drupal Date: 2022-May-25 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.20 || >= 9.3.0 <9.3.14 CVE IDs: CVE-2022-29248 Description: Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which does not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites. We are issuing this security advisory outside…
4月21日(木)
Drupal core - Moderately critical - Access bypass - SA-CORE-2022-009
Project: Drupal core Project machine name: drupal Date: 2022-April-20 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: >= 9.3.0 <9.3.12 CVE IDs: CVE-2022-25274 Description: Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content.…
Drupal core - Moderately critical - Improper input validation - SA-CORE-2022-008
Project: Drupal core Project machine name: drupal Date: 2022-April-20 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Improper input validation Affected versions: >= 8.0.0 <9.2.18 || >= 9.3.0 <9.3.12 CVE IDs: CVE-2022-25273 Description: Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter cr…
3月22日(火)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-006
Project: Drupal core Project machine name: drupal Date: 2022-March-21 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.16 || >= 9.3.0 <9.3.9 CVE IDs: CVE-2022-24775 Description: Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which may affect some Drupal sites. We are issuing this security advisory outside our regular Drupal security release window schedule since Guzzle has alr…
3月17日(木)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-005
Project: Drupal core Project machine name: drupal Date: 2022-March-16 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.15 || >= 9.3.0 <9.3.8 CVE IDs: CVE-2022-24728 CVE-2022-24729 Description: The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal . Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (e…