View online: https://www.drupal.org/sa-contrib-2024-042 Project: Diff [1] Date: 2024-October-02 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass, Information Disclosure Affected versions: <1.8.0 || >=2.0.0 <2.0.0-beta3 Description:  This module adds a tab for sufficiently permissioned users. The tab shows all revisions like standard Drupal but it also allows pretty viewing of all added/changed/deleted words between revisions. The module doesn't sufficiently check revision access before rendering a diff report for 1) nodes or 2) general entities that support diff. This vulnerability is mitigated by the fact that an attacker must have a role with the permission from the general node permission to "view all revisions", one of the more specific node type permissions, "view %bundle revisions" or the equivalent for other general entity types. Solution:  Install the latest version: * If you use the Diff module for Drupal, upgrade to Diff 8.x-1.8 [3] Reported By:  * Matthias Vogel [4] Fixed By:  * Matthias Vogel [5] * Lucas Hedding [6] * Adam Bramley [7] Coordinated By:  * Greg Knaddison [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team [1] https://www.drupal.org/project/diff [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/diff/releases/8.x-1.8 [4] https://www.drupal.org/user/3319139 [5] https://www.drupal.org/user/3319139 [6] https://www.drupal.org/user/1463982 [7] https://www.drupal.org/user/1036766 [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10