Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070
Project: Minify JSDate: 2024-December-04Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross site request forgeryAffected versions: <3.0.3Description: The Minify JS module allows a site administrator to minify all javascript files that exist in the site's code base and use those minified files on the front end of the website.
Several administrator routes are unprotected against Cross-Site Request Forgery (CRSF) attacks.Solution: Install the latest version:
- If you use the Minify JS module for Drupal 7.x, upgrade to Minify JS 7.x-1.11
- If you use the Minify JS module for Drupal 8.x, upgrade to Minify JS 3.0.3
Reported By:
Fixed By:
- Ivo Van Geertruyen of the Drupal Security Team
- Scott Joudry
Coordinated By:
- Ivo Van Geertruyen of the Drupal Security Team