View online: https://www.drupal.org/sa-contrib-2024-034 Project: Freelinking [1] Date: 2024-September-04 Security risk: *Moderately critical* 12∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure Affected versions: <4.0.1 Description:  This module enables you to configure a wiki-like input filter that allows users to create links to site and external content. The module doesn't sufficiently check if a user has access to some URLs before rendering them as links. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access content" (which is commonly assigned to all roles), and the site must be configured to disallow access to certain content. Solution:  Install the latest version: * If you use the freelinking module 4.0.x, upgrade to freelinking 4.0.1 [3] * If you use the freelinking module 8.x-3.x, upgrade to freelinking 4.0.1 [4], as the 8.x-3.x branch is now unsupported Reported By:  * Matthew Radcliffe [5] Fixed By:  * Matthew Radcliffe [6] * Gisle Hannemyr [7] Coordinated By:  * Greg Knaddison [8] of the Drupal Security Team * Damien McKenna [9] of the Drupal Security Team * Juraj Nemec [10] of the Drupal Security Team [1] https://www.drupal.org/project/freelinking [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/freelinking/releases/4.0.1 [4] https://www.drupal.org/project/freelinking/releases/4.0.1 [5] https://www.drupal.org/user/157079 [6] https://www.drupal.org/user/157079 [7] https://www.drupal.org/user/409554 [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/damienmckenna [10] https://www.drupal.org/user/272316