Critical Vulnerabilities Fixed in Drupal 7.29 and 6.32

  •  
  •  
  •  
  •  
  •  
  •  
  •  
  •  

According to Drupal Security Team, the DoS attack can be deployed by using a malicious HTTP Host header. This is achievable because the validation of the HTTP Host header is not properly conducted, and malcrafted header values could lead to denial of service.

Accessing private data is related to the File module available in Drupal 7, which allows to attach files to pieces of content. However, it appears that the module “doesn’t sufficiently check permission to view the attached file when attaching a file that was previously uploaded.”

The XSS vulnerabilities are considered moderately critical. One of them was possible because of Drupal’s form API improper sanitization of option group labels in select elements.

The other cross-site scripting flaw was discovered in the Ajax system and was encountered in forms that included a combination of an Ajax-enabled text field and a file field.

All of the vulnerabilities can be exploited remotely and, as such, users are strongly advised to upgrade their versions of Drupal to 7.29 or 6.32 in order to eliminate the critical security risks in the core of Drupal 6 and 7.

The following two tabs change content below.

Unallocated Author

Please note that the article you are reading has an unallocated author as the original author is no longer employed at latesthackingnews.com, this has been put in place to adhere with general data protection regulations (GDPR). If you have any further queries, please contact: [email protected]

Unallocated Author

Please note that the article you are reading has an unallocated author as the original author is no longer employed at latesthackingnews.com, this has been put in place to adhere with general data protection regulations (GDPR). If you have any further queries, please contact: [email protected]

Leave a Reply