High WID-SEC-2024-3686 4 CVEs

Drupal: Mehrere Schwachstellen ermöglichen

Published Dec 11, 2024 · Updated Feb 11, 2025 · Revision 3 · de-DE

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen oder einen unspezifischen Angriff auszuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 4

High 7.3

CVE-2024-13311

Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075

Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*.

Drupal Allow All File Extensions for file fields drupal/all_extensions Packagist

Jan 9, 2025
Medium 6.5

CVE-2024-13310

Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074

Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*.

Drupal Git Utilities for Drupal drupal/git_utils Web / CMS Packagist

Jan 9, 2025
Medium 5.3

CVE-2024-13312

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9.

Drupal Open Social

Jan 9, 2025
Low 3.8

CVE-2024-13308

Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.

Drupal Browser Back Button drupal/browser_back_button Packagist

Jan 9, 2025

Revision history

2025-02-11 #3
CVE-Nummern ergänzt
2025-01-09 #2
CVE ergänzt
2024-12-11 #1
Initiale Fassung

References

Drupal Security-news - SA-CONTRIB-2024-072 vom 2024-12-11
https://www.drupal.org/sa-contrib-2024-072
Drupal Security-news - SA-CONTRIB-2024-073 vom 2024-12-11
https://www.drupal.org/sa-contrib-2024-073
Drupal Security-news - SA-CONTRIB-2024-074 vom 2024-12-11
https://www.drupal.org/sa-contrib-2024-074
Drupal Security-news - SA-CONTRIB-2024-075 vom 2024-12-11
https://www.drupal.org/sa-contrib-2024-075
Drupal Security-news - SA-CONTRIB-2024-076 vom 2024-12-11
https://www.drupal.org/sa-contrib-2024-076