[Security-news] Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2024-042

Project: Diff [1]
Date: 2024-October-02
Security risk: *Moderately critical* 11 ∕ 25
AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2]
Vulnerability: Access bypass, Information Disclosure

Affected versions: <1.8.0 || >=2.0.0 <2.0.0-beta3
Description: 
This module adds a tab for sufficiently permissioned users. The tab shows all
revisions like standard Drupal but it also allows pretty viewing of all
added/changed/deleted words between revisions.

The module doesn't sufficiently check revision access before rendering a diff
report for 1) nodes or 2) general entities that support diff.

This vulnerability is mitigated by the fact that an attacker must have a role
with the permission from the general node permission to "view all revisions",
one of the more specific node type permissions, "view %bundle revisions" or
the equivalent for other general entity types.

Solution: 
Install the latest version:

   * If you use the Diff module for Drupal, upgrade to Diff 8.x-1.8 [3]

Reported By: 
   * Matthias Vogel [4]

Fixed By: 
   * Matthias Vogel [5]
   * Lucas Hedding [6]
   * Adam Bramley [7]

Coordinated By: 
   * Greg Knaddison [8] of the Drupal Security Team
   * Juraj Nemec [9] of the Drupal Security Team


[1] https://www.drupal.org/project/diff
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/diff/releases/8.x-1.8
[4] https://www.drupal.org/user/3319139
[5] https://www.drupal.org/user/3319139
[6] https://www.drupal.org/user/1463982
[7] https://www.drupal.org/user/1036766
[8] https://www.drupal.org/u/greggles
[9] https://www.drupal.org/u/poker10