Tag1 D7ES Security Advisories

The Open Atrium Notifications remove callback deletes a notification subscription in response to a GET request but never validates the security token that its own remove links attach. An attacker can forge a request that makes an authenticated victim remove notification subscriptions without their consent.

The Open Atrium Notifications remove callback deletes a notification subscription in response to a GET request but never validates the security token that its own remove links attach. An attacker can forge a request that makes an authenticated victim remove notification subscriptions without their consent.

The Open Atrium Notifications view template prints real names and group or team titles into an HTML title attribute without sanitization. A user who sets a crafted display name or group title can store markup that executes in the browser of anyone who views the notifications pane.

The Taxonomy File Tree module exposes menu callbacks that restore an archived folder or file, moving taxonomy terms and re-saving nodes, but it performs these changes on a plain GET request with no anti-CSRF token, so an attacker can cause a privileged user to move or restore tree elements simply by getting them to load a crafted URL.

The Taxonomy File Tree module prints taxonomy term and folder names verbatim into HTML links and headings across its file explorer block, folder tree, and AJAX content table, allowing a low privilege group member who can create or rename a folder to store cross site scripting that executes in the browser of every user who later views the tree.

The Taxonomy File Tree module builds the cancel link on its folder deletion form by inserting the raw destination query parameter into an anchor tag, allowing an attacker to craft a URL that injects arbitrary HTML into the page (reflected cross site scripting) or that points the cancel link at an external site (open redirect) for any user who opens the crafted link.

The Feedback Collect module stores the feedback origin value submitted with each feedback node and later prints it without sanitization in the submitted feedback administration listing and on the feedback node view, allowing a user who can submit feedback to inject arbitrary JavaScript that executes in the browser of any user who views the submitted feedback.

The Popup module exposes an anonymous AHAH callback that renders the body of the targeted content without re-checking the current user's access, allowing an anonymous visitor to retrieve content they should not be able to see, such as an unpublished node.

The video upload form accepts poster and thumbnail images using extension based validation only, so a privileged user can store a non-image file bearing an image extension at a public URL.

The Helper module's XML parsing utility did not disable external entity loading before parsing user-supplied XML, allowing an attacker to read arbitrary local files from the server via crafted XXE payloads.