[Security-news] Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2021-024

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2021-024

Project: Pages Restriction Access [1]
Date: 2021-July-28
Security risk: *Critical* 16∕25
AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Description: 
This project enables administrators to restrict access from anonymous and
regular users to pre-defined pages.

The administration routes used by the project lacked proper permissions,
allowing untrusted users to access, create and modify the module's settings.

Solution: 
Install the latest version:

   * If you use the Pages Restriction Access for Drupal 8.x, upgrade to Pages
     Restriction Access for Drupal 8.x-1.4 [3]

Reported By: 
   * Murilo Marchi [4]

Fixed By: 
   * Renato Gonçalves H [5]
   * Vitor Grillo [6]

Coordinated By: 
   * Chris McCafferty [7] of the Drupal Security Team
   * Greg Knaddison [8] of the Drupal Security Team


[1] https://www.drupal.org/project/pages_restriction
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/pages_restriction/releases/8.x-1.4
[4] https://www.drupal.org/user/3681454
[5] https://www.drupal.org/user/3326031
[6] https://www.drupal.org/user/3436121
[7] https://www.drupal.org/u/cilefen
[8] https://www.drupal.org/user/36762