[Security-news] Entity Registration - Moderately critical - Access bypass - SA-CONTRIB-2022-063

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2022-063

Project: Entity Registration [1]
Date: 2022-December-07
Security risk: *Moderately critical* 13∕25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass

Affected versions: >=7.1.0 <7.1.9
Description: 
This module enables you to create registration entities related to nodes.

The module doesn't sufficiently restrict update access to a user's own
registrations.

This vulnerability is mitigated by the fact that an attacker must have the
"update own [registration type]" permission.

Solution: 
Install the latest version:

   * If you use the Entity Registration module for Drupal 7.x, upgrade to
     Entity Registration 7.x-1.9 [3] release

*Note:* Sites that allow non-administrative users to manage registrations
because the users can update the registration host entity and have "update
own registration" permission for a given registration type, may need to give
those users the "administer own registration" permission for them to retain
the ability to manage registrations after installing this upgrade.

Reported By: 
   * Joël Pittet [4]

Fixed By: 
   * Joël Pittet [5]
   * Maria Fisher [6]
   * john.oltman [7]

Coordinated By: 
   * James Gilliland [8] of the Drupal Security Team

Reported at: 20 November 2022

[1] https://www.drupal.org/project/registration
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/registration/releases/7.x-1.9
[4] https://www.drupal.org/user/160302
[5] https://www.drupal.org/user/160302
[6] https://www.drupal.org/user/2210776
[7] https://www.drupal.org/user/699926
[8] https://www.drupal.org/user/48673