View online: https://www.drupal.org/sa-contrib-2018-060
Project: Renderkit [1] Date: 2018-September-19 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass
Description: This module, typically in combination with cfr:cfrplugin, allows to compose behaviors from granular components. One of such behaviors is to display a list of related entities, for a given source entity and a given entity relation (e.g. an entity reference field).
The components that display related content do not check if the user has access to view the related entities. This way e.g. unpublished nodes may be displayed to anonymous visitors.
This vulnerability is mitigated by the facts that - a site builder must have used the component that displays "related" entities for a source entity, using cfr:cfrplugin, OR a programmer has used one of the affected components in code. - a source entity displayed this way must reference access-restricted content.
Solution: Install the latest version:
* If you use the Renderkit module for Drupal 7.x, upgrade to Renderkit 7.x-1.6 [3]
Also see the Renderkit [4] project page.
Reported By: * Andreas Hennings [5]
Fixed By: * Andreas Hennings [6]
Coordinated By: * Lee Rowlands [7]
[1] https://www.drupal.org/project/renderkit [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/renderkit/releases/7.x-1.6 [4] https://www.drupal.org/project/renderkit [5] https://www.drupal.org/user/459338 [6] https://www.drupal.org/user/459338 [7] https://www.drupal.org/u/larowlan