Drupal Releases Security Updates

Five security advisories address multiple vulnerabilities affecting the Drupal platform

Threat ID:: CC-4288
Threat Severity:: Information only
Published:: 21 March 2023 11:51 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Five security advisories address multiple vulnerabilities affecting the Drupal platform

Affected platforms

The following platforms are known to be affected:

Drupal

Drupal Core
Media Responsive Thumbnail
Responsive Media Image Formatter

Threat details

Introduction

Drupal has released security updates to address multiple vulnerabilities. One vulnerability designated as SA-CORE-2023-004 affects Drupal Core, and could allow an attacker to use its phpinfo page to access sensitive information that could be used to escalate privileges.

The remaining security advisories that affect Drupal Core and Media Responsive Thumbnail describe vulnerabilities that could result in titles and thumbnails being rendered for users without authorised access.

In addition, a critical advisory in the Responsive Media Image Formatter has been issued following an undisclosed security issue and it is no longer supported by Drupal. Any future security issues will not be addressed on this platform and users are advised by Drupal to uninstall it or to contact them regarding taking over maintainership.

Remediation advice

Affected organisations are encouraged to review the Drupal security advisories and follow the relevant remediation steps.

Remediation steps

Type	Step
Action	Responsive media Image Formatter - Critical - Unsupported - SA-CONTRIB-2023-011 https://www.drupal.org/sa-contrib-2023-011
Patch	Media Responsive Thumbnail - Moderately critical - Information disclosure - SA-CONTRIB-2023-010 https://www.drupal.org/sa-contrib-2023-010
Patch	Drupal core - Moderately critical - Access bypass - SA-CORE-2023-004 https://www.drupal.org/sa-core-2023-004
Patch	Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-003 https://www.drupal.org/sa-core-2023-003
Patch	Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-002 https://www.drupal.org/sa-core-2023-002

Definitive source of threat updates

https://www.drupal.org/security

Last edited: 21 March 2023 11:51 am