Samuel Mortenson

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 8.0.0 through 10.3.13 Drupal core versions 10.4.0 through 10.4.4 Drupal core versions 11.0.0 through 11.0.12 Drupal core versions 11.1.0 through 11.1.4 **Description** The issue affects Drupal core, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. **Recommendations** For versions 8.0.0 through 10.3.13, update to version 10.3.14 or later. For versions 10.4.0 through 10.4.4, update to version 10.4.5 or later. For versions 11.0.0 through 11.0.12, update to version 11.0.13 or later. For versions 11.1.0 through 11.1.4, update to version 11.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Twig versions 1.x prior to 1.44.7 Twig versions 2.x prior to 2.15.3 Twig versions 3.x prior to 3.4.3 **Description** The issue arises when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. **Recommendations** For versions 1.x prior to 1.44.7, update to version 1.44.7 or later. For versions 2.x prior to 2.15.3, update to version 2.15.3 or later. For versions 3.x prior to 3.4.3, update to version 3.4.3 or later. As a temporary workaround, consider restricting the use of the `source` and `include` statements with user-input template names until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Drupal (affected versions not specified) **Description** The issue is related to the Quick Edit module in the Drupal content management system, which does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are not authorized to access. Sites are only affected if the QuickEdit module is installed. **Recommendations** For Drupal sites with the QuickEdit module installed, consider restricting access to the Quick Edit functionality until a proper fix is applied. As a temporary workaround, review and adjust the permissions related to "access in-place editing" to minimize the risk of unauthorized access to content. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Core versions prior to 9.0.8 Drupal Core versions prior to 8.9.9 Drupal Core versions prior to 8.8.11 Drupal Core versions prior to 7.74 **Description** The issue is related to the improper sanitization of certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This can allow a remote attacker to execute arbitrary PHP code on the server. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For Drupal Core versions prior to 9.0.8, update to version 9.0.8 or later. For Drupal Core versions prior to 8.9.9, update to version 8.9.9 or later. For Drupal Core versions prior to 8.8.11, update to version 8.8.11 or later. For Drupal Core versions prior to 7.74, update to version 7.74 or later. As a temporary workaround, consider restricting the upload of files to minimize the risk of exploitation. Avoid using the vulnerable file upload functionality until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Drupal Core versions prior to 7.73 Drupal Core 8.8.x versions prior to 8.8.10 Drupal Core 8.9.x versions prior to 8.9.6 Drupal Core 9.0.x versions prior to 9.0.6 **Description** The issue is related to a cross-site scripting vulnerability in Drupal Core, where the Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This can potentially impact the integrity of data. **Recommendations** For versions prior to 7.73, update to version 7.73 or later. For 8.8.x versions prior to 8.8.10, update to version 8.8.10 or later. For 8.9.x versions prior to 8.9.6, update to version 8.9.6 or later. For 9.0.x versions prior to 9.0.6, update to version 9.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Core (affected versions not specified) **Description** The issue is related to insufficient authentication of executed requests in the Drupal CMS system. It can be exploited by a remote attacker to execute arbitrary code. Additionally, there is a Cross Site Request Forgery vulnerability in the Drupal Core Form API, which does not properly handle certain form input from cross-site requests, potentially leading to other vulnerabilities. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GitLab Community and Enterprise Edition versions 8.1 through 12.2.1 **Description** An issue was discovered where certain areas displaying Markdown were not properly sanitizing some XSS payloads. **Recommendations** For GitLab Community and Enterprise Edition versions 8.1 through 12.2.1, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Drupal 8 versions prior to 8.3.4 **Description** The issue arises from improper validation of certain fields when manipulating files through the file REST resource. This affects sites with the RESTful Web Services (rest) module enabled, where the file REST resource is enabled and allows PATCH requests. An attacker must have the ability to get or register a user account on the site with permissions to upload files and to modify the file resource. **Recommendations** For versions prior to 8.3.4, update to version 8.3.4 or later to resolve the issue. As a temporary workaround, consider disabling the file REST resource or restricting access to it until the update can be applied. Additionally, restrict permissions to upload files and modify the file resource to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drupal 8 versions prior to 8.2.8 Drupal 8.3 versions prior to 8.3.1 **Description** The issue allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests. **Recommendations** For Drupal 8 versions prior to 8.2.8, update to version 8.2.8 or later. For Drupal 8.3 versions prior to 8.3.1, update to version 8.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal versions 8.2.x before 8.2.7 **Description** The issue affects some administrative paths that did not include protection for CSRF, allowing an attacker to disable certain blocks on a site. This is mitigated by the requirement for an attacker to know the block ID. **Recommendations** For versions 8.2.x before 8.2.7, update to version 8.2.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal versions prior to 7.41 jQuery Update module versions prior to 7.x-2.7 for Drupal LABjs module versions prior to 7.x-1.8 for Drupal **Description** The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is due to an incomplete fix for a previous issue. **Recommendations** For Drupal versions prior to 7.41, update to version 7.41 or later. For jQuery Update module versions prior to 7.x-2.7, update to version 7.x-2.7 or later. For LABjs module versions prior to 7.x-1.8, update to version 7.x-1.8 or later.