Tag1 D7ES Announcements

The Node Reference Create module does not verify whether the current user has permission to create the referenced content type before saving a new node via its autocomplete widget, allowing any authenticated user with access to a referencing form to create nodes without the corresponding permission.

When a CAPTCHA protects a form that has additional validation (such as the user login form), an incorrect CAPTCHA answer does not suppress the form's other validation errors. This lets an attacker read those errors without ever solving a CAPTCHA, defeating the brute-force protection and enabling enumeration of credentials or other field values.

The Mailchimp module exposed an administrative autocomplete endpoint to all users, including anonymous visitors. This allowed unauthenticated users to enumerate entity titles and IDs from the site.

The Add To Calendar module outputs calendar event data (title, description, location, organizer, dates, timezone, and privacy) into HTML "" tags without sanitization, allowing users with content editing permissions to inject arbitrary JavaScript via those fields.

The Image Editor module fetches image URLs supplied by the user in GET/POST parameters without validating the destination host, allowing an authenticated user to cause the server to make requests to internal network resources, including cloud metadata endpoints and loopback services.

The Basic HTTP Authentication module stored HTTP Basic HTTP Authentication passwords as plaintext in the database and rendered them in the HTML source of the admin configuration form, exposing credentials to any user with administrator access.

The Field API Pane Editor module exposed its field edit route to all users, including anonymous users, by omitting a proper access callback. An attacker could reach the field edit controller without authentication, though secondary entity and field access checks within the controller still limited practical exploitation.

The Entity Reports module was vulnerable to CSV injection attacks where malicious formulas could be executed when exported CSV files were opened in spreadsheet applications.

The Automated Logout module doesn't sufficiently protect its AJAX routes from cross-site request forgery (CSRF), allowing the logout route to be triggered without user interaction.

The Login One Time module lacked flood control protection against brute force attacks on one-time login links, allowing attackers to make unlimited attempts to guess valid login parameters.