[Security-news] FileField Sources - Moderately critical - Information Disclosure - SA-CONTRIB-2018-007

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2018-007

Project: FileField Sources [1]
Date: 2018-February-07
Security risk: *Moderately critical* 12∕25
AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All [2]
Vulnerability: Information Disclosure

Description: 
This module enables you to upload files to fields via several sources.

The module doesn't sufficiently handle access control under the scenario of
the autocomplete path of reference sources.

Solution: 
Install the latest version:

   * If you use the filefield_sources module provided reference source for
     Drupal 7.x, upgrade to 7.x-1.11. [3]

Reported By: 
   * Tatar Balazs Janos [4] Provisional Security Team member

Fixed By: 
   * Tatar Balazs Janos [5] Provisional Security Team member
   * Nate Lampton [6] the module maintainer

Coordinated By: 
   * Michael Hess [7] of the Drupal Security Team


[1] https://www.drupal.org/project/filefield_sources
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/filefield_sources/releases/7.x-1.11
[4] https://www.drupal.org/u/tatarbj
[5] https://www.drupal.org/u/tatarbj
[6] https://www.drupal.org/user/35821
[7] https://www.drupal.org/u/mlhess