View online: https://www.drupal.org/sa-contrib-2024-034

Project: Freelinking [1] Date: 2024-September-04 Security risk: *Moderately critical* 12∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure

Affected versions: <4.0.1 Description:  This module enables you to configure a wiki-like input filter that allows users to create links to site and external content.

The module doesn't sufficiently check if a user has access to some URLs before rendering them as links.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access content" (which is commonly assigned to all roles), and the site must be configured to disallow access to certain content.

Solution:  Install the latest version:

* If you use the freelinking module 4.0.x, upgrade to freelinking 4.0.1 [3] * If you use the freelinking module 8.x-3.x, upgrade to freelinking 4.0.1 [4], as the 8.x-3.x branch is now unsupported

Reported By:  * Matthew Radcliffe [5]

Fixed By:  * Matthew Radcliffe [6] * Gisle Hannemyr [7]

Coordinated By:  * Greg Knaddison [8] of the Drupal Security Team * Damien McKenna [9] of the Drupal Security Team * Juraj Nemec [10] of the Drupal Security Team

[1] https://www.drupal.org/project/freelinking [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/freelinking/releases/4.0.1 [4] https://www.drupal.org/project/freelinking/releases/4.0.1 [5] https://www.drupal.org/user/157079 [6] https://www.drupal.org/user/157079 [7] https://www.drupal.org/user/409554 [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/damienmckenna [10] https://www.drupal.org/user/272316