The AltaGrade Blog
Merry Christmas and Happy New Year!
As we are approaching the year 2020 we would like to thank you for entrusting your Drupal, Backdrop and WordPress websites to us. We appreciate your business with AltaGrade and assure you that we will deliver more convenient features to our hosting platform and better enhancements to our ticket processing and billing portal in 2020.
Multiple security advisories from Drupal Security team released today
Projects: Multiple
Date: 2019-November-13
Security risk: Critical
Vulnerability: UnsupportedDrupal Security team released multiple security advisories earlier today, notifying the following contributed modules and themes have been marked as unsupported and therefore should be either fixed or uninstalled:
Booking and Availability Management Tools for Drupal - Moderately critical - Access Bypass - SA-CONTRIB-2019-074
Project: Booking and Availability Management Tools for Drupal
Date: 2019-October-16
Security risk: Moderately critical 11∕25
Vulnerability: Access BypassDescription
The Bat module provides a foundation through which a wide range of availability management, reservation and booking use cases can be addressed.
The routes used to view events don't sufficiently guard access for non-privileged users. Specifically, a user with the 'View own' permission for bat events can view others' events as well.
Maintenance on all Germany-based servers
Type: Maintenance work
Category: Advanced infrastructure
Start: October 16, 2019 3:00 AM CEST
End: October 16, 2019 3:05 AM CESTDescription
In the above mentioned period maintenance on our European data-center will be performed. During this maintenance, the affected servers and the websites hosted accounts on them will not be available for about five minutes.
Affected clients
AltaGrade clients who have their projects hosted on Germany-based AltaGrade servers.
Maxlength - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-073
Project: Maxlength
Date: 2019-October-09
Security risk: Moderately critical 13∕25
Vulnerability: Cross Site ScriptingDescription
This module enables you to set a maximum length allowed on text fields and indicate how many characters are left.
The module doesn't sufficiently filter strings leading to a Cross Site Scripting (XSS) vulnerability.