Skip to content
OpenAdvisories
Medium WID-SEC-2024-1900 3 CVEs

Drupal Module: Mehrere Schwachstellen

Published Aug 21, 2024 · Updated Jan 9, 2025 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Modulen ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um beliebigen Code auszuführen oder einen Cross-Site-Scripting-Angriff durchzuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 3

  • High 7.5
    CVE-2024-13267

    Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.

    Drupal Opigno TinCan Question Type
  • Medium 6.8
    CVE-2024-13268

    Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.

    Drupal Opigno
  • Medium 5.3
    CVE-2024-13266

    Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030

    Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4.

    Drupal Responsive and off-canvas menu drupal/responsive_menu Packagist

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References