The AltaGrade Blog

reCAPTCHA v3 - Critical - Access bypass - SA-CONTRIB-2020-019

reCAPTCHA v3 - Critical - Access bypass - SA-CONTRIB-2020-019

Project: reCAPTCHA v3
Date: 2020-May-13
Security risk: Critical 18∕25 
Vulnerability: Access bypass

Description

The reCaptcha v3 module enables you to protect your forms using the Google reCaptcha V3.

If the reCaptcha v3 challenge succeeds, all the other form validations are bypassed. This makes it possible for attackers to submit invalid or incomplete forms.

Read More

Webform - Critical - Access bypass - SA-CONTRIB-2020-018

Webform - Critical - Access bypass - SA-CONTRIB-2020-018

Project: Webform
Date: 2020-May-13
Security risk: Critical 15∕25 
Vulnerability: Access bypass

Description

This webform module enables you to build a 'Term checkboxes' element.

The module doesn't sufficiently check term 'view' access when rendering 'Term checkboxes' elements. Unpublished terms will always appear in the 'Term checkboxes' element.

Read More

Drupal 8: Multiple critical and moderately critical security advisories for Webform module

Drupal 8: Multiple critical and moderately critical security advisories for Webform module

Drupal Security team has released multiple critical and moderately critical security advisories for Webform module today. This module enables you to build forms and surveys in Drupal.

Webform - Critical - Remote Code Execution - SA-CONTRIB-2020-011

Project: Webform
Date: 2020-May-06
Security risk: Critical 17∕25 
Vulnerability: Remote Code Execution
Read More

Spamicide - Critical - Access bypass - SA-CONTRIB-2020-009

Spamicide - Critical - Access bypass - SA-CONTRIB-2020-009

Project: Spamicide
Date: 2020-April-08
Security risk: Critical 18∕25 
Vulnerability: Access bypass

Description

The Spamicide module protects Drupal forms with a form field that is hidden from normal users, but visible to spam bots.

The module doesn't require appropriate permissions for administrative pages leading to an Access Bypass.

Solution

Install the latest version:

Read More

Svg Image - Critical - Cross site scripting - SA-CONTRIB-2020-008

Svg Image - Critical - Cross site scripting - SA-CONTRIB-2020-008

Project: Svg Image
Date: 2020-March-25
Security risk: Critical 15∕25
Vulnerability: Cross site scripting

Description

SVG Image module allows to upload SVG files.

The module did not sufficiently protect against malicious code inside SVG files leading to a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have permission to upload an SVG file.

Solution

Install the latest version:

Read More

Pages