CERT-In Vulnerability Note
CIVN-2022-0481
Multiple Vulnerabilities in Drupal
Original Issue Date:December 16, 2022
Severity Rating: CRITICAL
Software Affected
- H5P module version prior 7.1.51.
- File (Field) Paths module version prior 7.1.2.
Overview
Multiple vulnerabilities have been reported in Drupal which could allow an unauthenticated remote attacker to execute arbitrary code and bypass security restrictions on the targeted system.
Description
1. Access Bypass
This vulnerability exists in the File (Field) Paths module due to extends the default functionality of Drupals core File module. A remote attacker could exploit this vulnerability by guessing the temporary path used for file upload.
Successful exploitation of this vulnerability could allow an attacker to bypass and manage security restrictions.
2. Remote Code Execution
This vulnerability exists in the H5P module due to insufficient stop path traversal. An attacker could exploit this vulnerability with "update h5p libraries" permission to gain unauthorized access.
Successful exploitation of this vulnerability could allow an attacker to perform remote code execution on the targeted system.
Solution
Apply appropriate updates as mentioned:
https://www.drupal.org/project/h5p/releases/7.x-1.51
https://www.drupal.org/project/filefield_paths/releases/7.x-1.2
Vendor Information
Drupal
https://www.drupal.org/
References
Drupal
https://www.drupal.org/sa-contrib-2022-064
https://www.drupal.org/sa-contrib-2022-065
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|