View online: https://www.drupal.org/sa-contrib-2019-074
Project: Booking and Availability Management Tools for Drupal [1] Date: 2019-October-16 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access Bypass
Description: The Bat module provides a foundation through which a wide range of availability management, reservation and booking use cases can be addressed.
The routes used to view events don't sufficiently guard access for non-privileged users. Specifically, a user with the 'View own' permission for bat events can view others' events as well.
Solution: Install the latest version:
* If you use the bat module for Drupal 8.x, upgrade to bat 8.x-1.2 [3]
Also see the Booking and Availability Management Tools for Drupal [4] project page.
Reported By: * Jelle Sebreghts [5]
Fixed By: * Adrian Rollett [6] * Lee Rowlands [7] of the Drupal Security Team * Jelle Sebreghts [8]
Coordinated By: * Greg Knaddison [9] of the Drupal Security Team
[1] https://www.drupal.org/project/bat [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/bat/releases/8.x-1.2 [4] https://www.drupal.org/project/bat [5] https://www.drupal.org/user/829198 [6] https://www.drupal.org/user/253909 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/829198 [9] https://www.drupal.org/user/36762