Critical Vulnerabilities Fixed in Drupal 7.29 and 6.32

According to Drupal Security Team, the DoS attack can be deployed by using a malicious HTTP Host header. This is achievable because the validation of the HTTP Host header is not properly conducted, and malcrafted header values could lead to denial of service.

Accessing private data is related to the File module available in Drupal 7, which allows to attach files to pieces of content. However, it appears that the module “doesn’t sufficiently check permission to view the attached file when attaching a file that was previously uploaded.”

The XSS vulnerabilities are considered moderately critical. One of them was possible because of Drupal’s form API improper sanitization of option group labels in select elements.

The other cross-site scripting flaw was discovered in the Ajax system and was encountered in forms that included a combination of an Ajax-enabled text field and a file field.

All of the vulnerabilities can be exploited remotely and, as such, users are strongly advised to upgrade their versions of Drupal to 7.29 or 6.32 in order to eliminate the critical security risks in the core of Drupal 6 and 7.

Related posts

Google Fixed Two Critical Vulnerabilities With Android March 2023 Update

Vulnerabilities In TPM 2.0 Could Expose Cryptographic Keys

Snapchat Vulnerability Could Allow Deleting Users’ Content Spotlight