[Security-news] Mail Login - Moderately critical - Access bypass - SA-CONTRIB-2021-047

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2021-047

Project: Mail Login [1]
Date: 2021-December-22
Security risk: *Moderately critical* 14∕25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Description: 
This modules enables users to login via email address.

This module does not sufficiently check user status when authenticating.

Solution: 
Install the latest version:

   * If you use the mail_login module for Drupal 8 or 9, upgrade to Mail Login
     8.x-2.5 [3]

Reported By: 
   * seroton [4]
   * Abhishek Vishwakarma [5]
   * Dmitriy.trt [6]

Fixed By: 
   * Abhishek Vishwakarma [7]
   * Mohammad AlQanneh [8]

Coordinated By: 
   * Chris [9] of the Drupal Security Team
   * Greg Knaddison [10] of the Drupal Security Team
   * Damien McKenna [11] of the Drupal Security Team
   * Drew Webber [12] of the Drupal Security Team


[1] https://www.drupal.org/project/mail_login
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/mail_login/releases/8.x-2.5
[4] https://www.drupal.org/user/1473154
[5] https://www.drupal.org/user/896554
[6] https://www.drupal.org/user/329125
[7] https://www.drupal.org/user/896554
[8] https://www.drupal.org/user/2833163
[9] https://www.drupal.org/user/1850070
[10] https://www.drupal.org/user/36762
[11] https://www.drupal.org/user/108450
[12] https://www.drupal.org/user/255969