Security-news

Download

security-news@drupal.org

February 2020

1 participants
2 discussions

Profile - Moderately critical - Access Bypass - SA-CONTRIB-2020-004
by security-news＠drupal.org 19 Feb '20

19 Feb '20

View online: https://www.drupal.org/sa-contrib-2020-004 Project: Profile [1] Date: 2020-February-19 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access Bypass Description: The Profile module enables you to allow users to have configurable user profiles. The module doesn't sufficiently check access when creating a user profile. Users with the "create profiles" permission could create profiles for any users. Solution: Install the latest version: * If you use the Profile module for Drupal 8.x, upgrade to Profile 8.x-1.1 [3] Also see the Profile [4] project page. Reported By: * karl972 [5] Fixed By: * Matt Glaman [6] * Bojan Živanović [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/profile [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/profile/releases/8.x-1.1 [4] https://www.drupal.org/project/profile [5] https://www.drupal.org/user/1541584 [6] https://www.drupal.org/user/2416470 [7] https://www.drupal.org/user/86106 [8] https://www.drupal.org/user/36762

1 0

Views Bulk Operations (VBO) - Moderately critical - Access bypass - SA-CONTRIB-2020-003
by security-news＠drupal.org 05 Feb '20

05 Feb '20

View online: https://www.drupal.org/sa-contrib-2020-003 Project: Views Bulk Operations (VBO) [1] Date: 2020-February-05 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: Views Bulk Operations provides enhancements to running bulk actions on views. The module contains an access bypass vulnerability that might allow users to execute views actions that they should not have access to. This vulnerability is mitigated by the fact that it only occurs in the case of customised action access (by means of hook_action_info_alter). Solution: Install the latest version: * If you use Views Bulk Operations version 3.x for Drupal 8.x, upgrade to Views Bulk Operations 8.x-3.4 [3] * If you use Views Bulk Operations version 2.x for Drupal 8.x, upgrade to Views Bulk Operations 8.x-2.6 [4] Also see the Views Bulk Operations (VBO) [5] project page. Reported By: * Adam Shepherd [6] Fixed By: * Adam Shepherd [7] * Marcin Grabias [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/views_bulk_operations [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/views_bulk_operations/releases/8.x-3.4 [4] https://www.drupal.org/project/views_bulk_operations/releases/8.x-2.6 [5] https://www.drupal.org/project/views_bulk_operations [6] https://www.drupal.org/user/2650563 [7] https://www.drupal.org/user/2650563 [8] https://www.drupal.org/user/1599440 [9] https://www.drupal.org/user/36762

1 0