Tag1 D7ES Security Advisories

The Fit Text module embeds admin-supplied jQuery selectors directly into inline JavaScript without encoding, allowing a user with the "administer fittext" permission to inject arbitrary JavaScript that executes in every site visitor's browser on every page load.

The Bootstrap Carousel module fails to sanitize carousel caption text and video ID values before rendering them as HTML, allowing authenticated users with content creation permissions to inject arbitrary scripts that execute in the browsers of site visitors.

The Facebook Wall module renders post messages, story text, link names, captions, descriptions, commenter names, and comment messages from the Facebook Graph API without sanitization, allowing any Facebook user who can post or comment on the displayed page to inject arbitrary JavaScript into the Drupal site. URLs from API responses (post links, images, video sources) are also output without sanitization.

When a CAPTCHA protects a form that has additional validation (such as the user login form), an incorrect CAPTCHA answer does not suppress the form's other validation errors. This lets an attacker read those errors without ever solving a CAPTCHA, defeating the brute-force protection and enabling enumeration of credentials or other field values.

The Basic HTTP Authentication module stored HTTP Basic HTTP Authentication passwords as plaintext in the database and rendered them in the HTML source of the admin configuration form, exposing credentials to any user with administrator access.

The Image Editor module fetches image URLs supplied by the user in GET/POST parameters without validating the destination host, allowing an authenticated user to cause the server to make requests to internal network resources, including cloud metadata endpoints and loopback services.

The Field API Pane Editor module exposed its field edit route to all users, including anonymous users, by omitting a proper access callback. An attacker could reach the field edit controller without authentication, though secondary entity and field access checks within the controller still limited practical exploitation.

The module has been updated to use consistent error messaging for all login failure cases. Instead of using "drupal_access_denied()", the module now displays a generic error message: "You have tried to use a one-time login link that is invalid or has expired. Please use the log in form to supply your username and password." and redirects users to the login page.

The TableField module was vulnerable to CSV injection attacks where table cell values containing formula-starting characters were written to exported CSV files without sanitization, allowing malicious formulas to execute when the file was opened in a spreadsheet application.

The FileField Sources module's remote URL source allows authenticated users to supply arbitrary URLs that are fetched via cURL. Before the fix, no restrictions prevented those URLs from targeting internal or reserved IP addresses, or from using non-HTTP schemes, enabling attackers to probe or interact with internal network services.