Anti-Spam by CleanTalk - Moderately critical - SQL Injection - SA-CONTRIB-2022-032

Project:

Project machine name:

cleantalk

Date:

2022-March-30

Security risk:

Moderately critical 14 ∕ 25 AC:Basic/A:None/CI:None/II:All/E:Theoretical/TD:Default

Vulnerability:

SQL Injection

Affected versions:

<4.15.0 || >=9.1.0 <9.1.21

Description:

This module provides integration with the CleanTalk spam protection service.

The module does not properly filter data in certain circumstances.

Update: 2022-03-31 - fix release node links

Solution:

Install the latest version:

If you use the Anti Spam by CleanTalk module for Drupal 8.x, upgrade to Anti Spam by CleanTalk 8.x-4.15
If you use the Anti Spam by CleanTalk module for Drupal 9.x, upgrade to Anti Spam by CleanTalk 9.1.21

Reported By:

Fixed By:

Coordinated By:

Contact and more information

The Drupal security team can be reached by email at security at drupal.org or via the contact form.

Follow the Drupal Security Team on Bluesky, or Mastodon or Linkedin.

The security team is made up of volunteers around the world. The companies above have sponsored time on this release.