DRUPAL-CONTRIB-2019-065 This module that allows you to store external images on your server and apply your own Image Styles.
The module leaks cookies to external sites during image requests, allowing attackers to steal session data unless whitelisting is configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is DRUPAL-CONTRIB-2019-065?
DRUPAL-CONTRIB-2019-065 is a vulnerability in drupal/imagecache_external, published on 21 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This module that allows you to store external images on your server and apply your own Image Styles.
The module exposes cookies to external sites when making external image requests.
This vulnerability is mitigated by using the whitelisted host feature to restrict external image requests from trusted sources.
Which versions are affected by DRUPAL-CONTRIB-2019-065?
Linux distribution packages (1)
drupal/imagecache_external Packagist:https://packages.drupal.org/8 | From 1.0.0 to 1.0.0 | None |
How do I fix DRUPAL-CONTRIB-2019-065?
No fix has been published for DRUPAL-CONTRIB-2019-065 yet. Limit exposure of the affected software until one is available.
Is DRUPAL-CONTRIB-2019-065 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2019-065 in the wild and no public exploit code.