7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
53.1%
Drupal provides a mechanism to alter database SELECT
queries before they are executed. Contributed and custom modules may use this mechanism to restrict access to certain entities by implementing hook_query_alter()
or hook_query_TAG_alter()
in order to add additional conditions. Queries can be distinguished by means of query tags. As the documentation on EntityFieldQuery::addTag() suggests, access-tags on entity queries normally follow the form ENTITY_TYPE_access
(e.g. node_access
). However, the taxonomy module’s access query tag predated this system and used term_access
as the query tag instead of taxonomy_term_access
.
As a result, before this security release modules wishing to restrict access to taxonomy terms may have implemented an unsupported tag, or needed to look for both tags (term_access
and taxonomy_term_access
) in order to be compatible with queries generated both by Drupal core as well as those generated by contributed modules like Entity Reference. Otherwise information on taxonomy terms might have been disclosed to unprivileged users.
The user password reset form does not specify a proper cache context, which can lead to cache poisoning and unwanted content on the page.
Under certain circumstances, malicious users could construct a URL to a confirmation form that would trick users into being redirected to a 3rd party website after interacting with the form, thereby exposing the users to potential social engineering attacks.
A specially crafted URL can cause a denial of service via the transliterate mechanism.
Install the latest version:
Also see the Drupal core project page.
Inconsistent name for term access query:
Incorrect cache context on password reset page:
Confirmation forms allow external URLs to be injected:
Denial of service via transliterate mechanism:
Inconsistent name for term access query:
Incorrect cache context on password reset page:
Confirmation forms allow external URLs to be injected:
Denial of service via transliterate mechanism:
api.drupal.org/api/drupal/includes!entity.inc/function/EntityFieldQuery%3A%3AaddTag/7.x
twitter.com/drupalsecurity
www.drupal.org/contact
www.drupal.org/project/drupal
www.drupal.org/project/drupal/releases/7.52
www.drupal.org/project/drupal/releases/8.2.3
www.drupal.org/security-team
www.drupal.org/security-team/risk-levels
www.drupal.org/security/secure-configuration
www.drupal.org/u/catch
www.drupal.org/u/charlotteb
www.drupal.org/u/cilefen
www.drupal.org/u/Crell
www.drupal.org/u/dave-reid
www.drupal.org/u/David_Rothstein
www.drupal.org/u/dawehner
www.drupal.org/u/ezraw
www.drupal.org/u/Heine
www.drupal.org/u/jnicola
www.drupal.org/u/larowlan
www.drupal.org/u/mlhess
www.drupal.org/u/pwolanin
www.drupal.org/u/quicksketch
www.drupal.org/u/yesct
www.drupal.org/user/157725
www.drupal.org/user/63999
www.drupal.org/user/65776
www.drupal.org/writing-secure-code
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
53.1%