Sudhanshu Dhage

**Name of the Vulnerable Software and Affected Versions** Drupal SAML SSO - Service Provider versions 0.0.0 through 3.1.3 **Description** This module enables SAML-protocol-based single-sign-on (SSO) on a Drupal site. An improper check for unusual or exceptional conditions allows for an authentication bypass, which can lead to privilege escalation. **Recommendations** Update to version 3.1.4.

**Name of the Vulnerable Software and Affected Versions** Drupal SAML SSO - Service Provider versions prior to 3.1.3 **Description** The Drupal SAML SSO - Service Provider module does not properly sanitize user input, leading to a reflected Cross-Site Scripting (XSS) issue. This allows attackers to inject malicious scripts into web pages generated by the application. The module enables single sign-on (SSO) using the SAML protocol on Drupal sites. **Recommendations** Update Drupal SAML SSO - Service Provider to version 3.1.3 or later.

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.8.0 Enterprise MFA - TFA for Drupal versions 5.2.0 through 5.2.0 Enterprise MFA - TFA for Drupal versions 0.0.0 through 5.0.* Enterprise MFA - TFA for Drupal versions 0.0.0 through 5.1.* Description: The issue affects the Enterprise MFA - TFA for Drupal module, allowing authentication bypass using an alternate path or channel. This is due to the module not sufficiently ensuring that known authorization routes are protected. Recommendations: For versions 0.0.0 through 4.8.0, update to version 4.8.0 or later. For version 5.2.0, update to version 5.2.1 or later. For versions 0.0.0 through 5.0.*, update to version 5.0.* or later. For versions 0.0.0 through 5.1.*, update to version 5.1.* or later. As a temporary workaround, consider restricting access to known authorization routes to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x Description: The issue is related to a Missing Authorization vulnerability in Enterprise MFA - TFA for Drupal, which allows Forceful Browsing. Recommendations: For versions 0.0.0 through 4.6.x, update to version 4.7.0 or later. For versions 5.0.0 through 5.1.x, update to version 5.2.0 or later.

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x Description: The issue is related to an Authentication Bypass by Capture-replay vulnerability in Enterprise MFA - TFA for Drupal. This allows remote services to be accessed with stolen credentials. Recommendations: For Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x, update to version 4.7.0 or later. For Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x, update to version 5.2.0 or later.

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel vulnerability in Enterprise MFA - TFA for Drupal, allowing authentication bypass. Recommendations: For Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x, update to version 4.7.0 or later. For Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x, update to version 5.2.0 or later.

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel vulnerability in Enterprise MFA - TFA for Drupal, allowing authentication bypass. Recommendations: For Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x, update to version 4.7.0 or later. For Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x, update to version 5.2.0 or later.

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x Description: A Cross-Site Request Forgery (CSRF) issue affects the software, allowing unauthorized actions. This issue may be exploited through `API Endpoints` or by manipulating `user id` variables, although specific details about exploitation are not provided. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Recommendations: For versions 0.0.0 through 4.6.x, update to version 4.7.0 or later. For versions 5.0.0 through 5.1.x, update to version 5.2.0 or later.