The AltaGrade Blog

Config Pages - Moderately critical - Information Disclosure - SA-CONTRIB-2023-037

Nurlan Bayaman's picture

Nurlan

Aug 23, 2023
Add comment

Config Pages - Moderately critical - Information Disclosure - SA-CONTRIB-2023-037

Project: Config Pages
Version: 8.x-2.8, 8.x-2.7, 8.x-2.6, 8.x-2.5,8.x-2.4, 8.x-2.3, 8.x-2.2, 8.x-2.1, 8.x-2.0
Date: 2023-August-23
Security risk: Moderately critical 12∕25
Vulnerability: Information Disclosure
Affected versions:

Description

This module enables you to build administrative pages for managing configuration objects, which may then be used elsewhere in the site.

The module doesn't sufficiently validate access when the JSONAPI module is also installed.

Read More

ACL - Critical - Arbitrary PHP code execution - SA-CONTRIB-2023-034

Nurlan Bayaman's picture

Nurlan

Aug 23, 2023
Add comment

ACL - Critical - Arbitrary PHP code execution - SA-CONTRIB-2023-034

Project: ACL
Date: 2023-August-23
Security risk: Critical 17∕25
Vulnerability: Arbitrary PHP code execution
Affected versions:

Description

The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes.

The module processes user input in a way that could be unsafe. This can lead to Remote Code Execution via Object Injection.

Read More

AddToAny Share Buttons - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-019

Nurlan Bayaman's picture

Nurlan

Jun 1, 2023
Add comment

AddToAny Share Buttons - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-019

Project: AddToAny Share Buttons
Date: 2023-May-31
Security risk: Moderately critical 13∕25
Vulnerability: Cross Site Scripting

Description

This module provides social media share & follow buttons.

The module doesn't sufficiently restrict AddToAny block settings to users who have permission to administer AddToAny. This allows users with lower permission to configure malicious code leading to a Cross Site Scripting (XSS) vulnerability.

Read More