[Security-news] Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2024-008

Project: Migrate Tools [1]
Date: 2024-February-07
Security risk: *Moderately critical* 12∕25
AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross Site Request Forgery

Affected versions: <6.0.3
Description: 
The Migrate Tools module provides tools for running and managing Drupal
migrations.

The module doesn't sufficiently protect against Cross Site Request Forgery
under specific scenarios allowing an attacker to initiate a migration.

This vulnerability is mitigated by the fact that an attacker must know the
name of the migration.

Solution: 
Install the latest version:

   * If you use the Migrate Tools module for Drupal 10, upgrade to Migrate
     Tools 6.0.3 [3]

Reported By: 
   * Andreas Hennings [4]

Fixed By: 
   * Andreas Hennings [5]
   * Lucas Hedding [6]

Coordinated By: 
   * Greg Knaddison [7] of the Drupal Security Team


[1] https://www.drupal.org/project/migrate_tools
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/migrate_tools/releases/6.0.3
[4] https://www.drupal.org/user/459338
[5] https://www.drupal.org/user/459338
[6] https://www.drupal.org/user/1463982
[7] https://www.drupal.org/user/36762