Critical Vulnerabilities Fixed in Drupal 7.29 and 6.32

According to Drupal Security Team, the DoS attack can be deployed by using a malicious HTTP Host header. This is achievable because the validation of the HTTP Host header is not properly conducted, and malcrafted header values could lead to denial of service.

Accessing private data is related to the File module available in Drupal 7, which allows to attach files to pieces of content. However, it appears that the module “doesn’t sufficiently check permission to view the attached file when attaching a file that was previously uploaded.”

The XSS vulnerabilities are considered moderately critical. One of them was possible because of Drupal’s form API improper sanitization of option group labels in select elements.

The other cross-site scripting flaw was discovered in the Ajax system and was encountered in forms that included a combination of an Ajax-enabled text field and a file field.

All of the vulnerabilities can be exploited remotely and, as such, users are strongly advised to upgrade their versions of Drupal to 7.29 or 6.32 in order to eliminate the critical security risks in the core of Drupal 6 and 7.

Related posts

Microsoft Patch Tuesday February 2025 Fixes Some Zero-Day Flaws

Microsoft Patch Tuesday February 2025 Fixes Some Zero-Day Flaws

CISA Warns Of Actively Exploited Vulnerability In Microsoft Outlook

CISA Warns Of Actively Exploited Vulnerability In Microsoft Outlook

Unpatched Vulnerabilities Exist In RealHome Theme And Plugin