View online: https://www.drupal.org/sa-contrib-2018-007
Project: FileField Sources [1] Date: 2018-February-07 Security risk: *Moderately critical* 12∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Information Disclosure
Description: This module enables you to upload files to fields via several sources.
The module doesn't sufficiently handle access control under the scenario of the autocomplete path of reference sources.
Solution: Install the latest version:
* If you use the filefield_sources module provided reference source for Drupal 7.x, upgrade to 7.x-1.11. [3]
Reported By: * Tatar Balazs Janos [4] Provisional Security Team member
Fixed By: * Tatar Balazs Janos [5] Provisional Security Team member * Nate Lampton [6] the module maintainer
Coordinated By: * Michael Hess [7] of the Drupal Security Team
[1] https://www.drupal.org/project/filefield_sources [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/filefield_sources/releases/7.x-1.11 [4] https://www.drupal.org/u/tatarbj [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/user/35821 [7] https://www.drupal.org/u/mlhess