Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031
Project: Opigno TinCan Question TypeDate: 2024-August-21Security risk: Critical 16∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Arbitrary PHP code executionDescription: The Opigno TinCan Question Type module is related to Opigno LMS distribution. The module adds a new question type for the Quiz module. With this new question type, you will be able to import TinCan Packages to your Drupal instance and to use it as a question.
Uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution (RCE) and/or Cross Site Scripting (XSS).
This vulnerability is mitigated by the fact that it requires the attacker have a role with the permission to create or edit "TinCan Package" content type.Solution: Install the latest version:
- If you use the opigno_tincan_question_type module, upgrade to opigno_tincan_question_type 7.x-1.3
Reported By:
- Juraj Nemec of the Drupal Security Team
- Marcin Grabias
- catch of the Drupal Security Team
Fixed By:
- Juraj Nemec of the Drupal Security Team
- Axel Minck
- Yurii Boichenko
Coordinated By:
- Greg Knaddison of the Drupal Security Team
- Juraj Nemec of the Drupal Security Team
