View online: https://www.drupal.org/sa-contrib-2019-045
Project: TableField [1] Date: 2019-April-17 Security risk: *Critical* 16∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Remote Code Execution
Description: This module allows you to attach tabular data to an entity.
The module doesn't sufficiently determine that the data being unserialized is the contents of a tablefield when users request a CSV export, which could lead to Remote Code Execution via Object Injection.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission 'export tablefield', and be able to insert a payload into an entity's field.
Solution: Install the latest version:
* If you use the Tablefield module 7.x-3.x branch for Drupal 7.x, upgrade to tablefield 7.x-3.4 [3]
Reported By: * Drew Webber [4] Provisional Security Team Member
Fixed By: * Drew Webber [5] Provisional Security Team Member * Martin Postma [6] * Jen Lampton [7]
Coordinated By: * Greg Knaddison [8] of the Drupal Security Team
[1] https://www.drupal.org/project/tablefield [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tablefield/releases/7.x-3.4 [4] https://www.drupal.org/user/255969 [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/210402 [7] https://www.drupal.org/user/85586 [8] https://www.drupal.org/user/36762