View online: https://drupal.org/node/2248171 * Advisory ID: DRUPAL-SA-CONTRIB-2014-045 * Project: Drupal Commons [1] (third-party module) * Version: 7.x * Date: 2014-April-23 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This SA contains two patches against Drupal Commons .... Views Bulk Operations Access Bypass Drupal commons comes with a view to moderate reported content, which is intended for authenticated users to view which content has been reported. Since it has hard coded VBO operations within the view, and Drupal Commons doesn't come with the VBO 'access_permissions' submodule enabled, all views bulk operations can be performed by anyone with access to the view. In its default setting, this allows users to delete content from other users and potentially ban other users from the site. .... Anonymous Users can view Wiki revisions regardless of group privacy Commons allows users of a group to edit a wiki created by anyone, regardless of edit permissions. It is supposed to refer back to the group permissions when creating this edit permission. However, the revisions permission hook allows anyone (anonymous or authenticated) to view revisions and diffs between revisions. This can potentially leak hidden data from groups a user does not otherwise have access to. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal Commons 7.x-3.x versions prior to 7.x-3.10. Drupal core is not affected. If you do not use the contributed Drupal Commons [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Drupal Commons distribution for Drupal 7.x, upgrade to Drupal Commons 7.x-3.10 [5] Also see the Drupal Commons [6] project page. -------- REPORTED BY --------------------------------------------------------- * Ezra Gildesgame [7] * Jakub Suchy [8] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Jakob Perry [9] the module maintainer * Devin Carlson [10] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Ben Jeavons [11] of the Drupal Security Team * David Stoline [12] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [17] [1] http://drupal.org/project/commons [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/commons [5] https://drupal.org/node/2248299 [6] http://drupal.org/project/commons [7] https://drupal.org/user/69959 [8] https://drupal.org/user/31977 [9] https://drupal.org/user/45640 [10] https://drupal.org/user/290182 [11] https://drupal.org/user/91990 [12] https://drupal.org/user/329570 [13] http://drupal.org/contact [14] http://drupal.org/security-team [15] http://drupal.org/writing-secure-code [16] http://drupal.org/security/secure-configuration [17] https://twitter.com/drupalsecurity