[Security-news] Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2024-034

Project: Freelinking [1]
Date: 2024-September-04
Security risk: *Moderately critical* 12∕25
AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Information Disclosure

Affected versions: <4.0.1
Description: 
This module enables you to configure a wiki-like input filter that allows
users to create links to site and external content.

The module doesn't sufficiently check if a user has access to some URLs
before rendering them as links.

This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "access content" (which is commonly assigned to all
roles), and the site must be configured to disallow access to certain
content.

Solution: 
Install the latest version:

   * If you use the freelinking module 4.0.x, upgrade to freelinking 4.0.1 [3]
   * If you use the freelinking module 8.x-3.x, upgrade to freelinking 4.0.1
     [4], as the 8.x-3.x branch is now unsupported

Reported By: 
   * Matthew Radcliffe [5]

Fixed By: 
   * Matthew Radcliffe [6]
   * Gisle Hannemyr [7]

Coordinated By: 
   * Greg Knaddison [8] of the Drupal Security Team
   * Damien McKenna [9] of the Drupal Security Team
   * Juraj Nemec [10] of the Drupal Security Team


[1] https://www.drupal.org/project/freelinking
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/freelinking/releases/4.0.1
[4] https://www.drupal.org/project/freelinking/releases/4.0.1
[5] https://www.drupal.org/user/157079
[6] https://www.drupal.org/user/157079
[7] https://www.drupal.org/user/409554
[8] https://www.drupal.org/u/greggles
[9] https://www.drupal.org/u/damienmckenna
[10] https://www.drupal.org/user/272316