[Security-news] Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2024-041

Project: Smart IP Ban [1]
Date: 2024-September-18
Security risk: *Critical* 18 ∕ 25
AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Description: 
The Smart IP Ban module enables a site to automatically ban an IP address
based upon too many failed authentications.

The module doesn't sufficiently protect access to certain paths provided by
the module allowing a malicious user to view and modify the settings.

Solution: 
Install the latest version:

   * If you use the Smart IP Ban module for Drupal 7.x, upgrade to Smart IP 
Ban
     7.x-1.1 [3]

Reported By: 
   * Shawn Gants [4]

Fixed By: 
   * Sivaji Ganesh Jojodae [5]

Coordinated By: 
   * Greg Knaddison [6] of the Drupal Security Team
   * Damien McKenna [7] of the Drupal Security Team
   * Juraj Nemec [8] of the Drupal Security Team


[1] https://www.drupal.org/project/smart_ip_ban
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/smart_ip_ban/releases/7.x-1.1
[4] https://www.drupal.org/user/2351786
[5] https://www.drupal.org/user/328724
[6] https://www.drupal.org/user/36762
[7] https://www.drupal.org/u/DamienMcKenna
[8] https://www.drupal.org/u/poker10