View online: https://drupal.org/node/2135257
* Advisory ID: DRUPAL-SA-CONTRIB-2013-090 * Project: Revisioning [1] (third-party module) * Version: 7.x * Date: 2013-November-13 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass
-------- DESCRIPTION ---------------------------------------------------------
This module enables you to create content publication workflows whereby one version of the content is "live" (publicly visible), while another is being edited and moderated privately until found fit for publication. The module doesn't sufficiently apply node access permissions when used in combination with BOTH the Scheduler module AND a module that modifies the node access permissions table.
As a result it is possible that content that was Scheduled to be unpublished can still be viewed by authenticated users who, based on the node access table, should no longer have permission to view this content.
This vulnerability is mitigated by the fact that this only occurs for Authenticated users for Scheduled content on Drupal sites with the combination of all three modules: Revisioning, Scheduler and a module that modifies the node access table conditional on the publication status of the content. In this report this was the Organic Groups Moderation module.
-------- CVE IDENTIFIER(S) ISSUED --------------------------------------------
* /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./
-------- VERSIONS AFFECTED ---------------------------------------------------
* Revisioning 7.x-1.x versions prior to 7.x-1.6
Drupal core is not affected. If you do not use the contributed Revisioning [4] module, there is nothing you need to do.
-------- SOLUTION ------------------------------------------------------------
Install the latest version:
* If you use the Revisioning module, version 7.x-1.5 or older, upgrade to Revisioning 7.x-1.6 [5]
Also see the Revisioning [6] project page.
-------- REPORTED BY ---------------------------------------------------------
* Pete Gillis [7]
-------- FIXED BY ------------------------------------------------------------
* Rik de Boer [8], the module maintainer, with assistance from Pete Gillis [9]
-------- COORDINATED BY ------------------------------------------------------
* Greg Knaddison [10] of the Drupal Security Team
-------- CONTACT AND MORE INFORMATION ----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11].
Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14].
[1] http://drupal.org/project/revisioning [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/revisioning [5] https://drupal.org/node/2133555 [6] http://drupal.org/project/revisioning [7] http://drupal.org/user/373976 [8] http://drupal.org/user/404007 [9] http://drupal.org/user/373976 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration