GHSA-mh4h-27gq-cxwj
Drupal core Access bypass
At a glance
- Published
- Updated
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations. Solution: If you are using Drupal 8.7.x, you should upgrade to Drupal 8.7.11. If you are using Drupal 8.8.x, you should upgrade to Drupal 8.8.1. Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage. Alternatively, you may mitigate this vulnerability by unchecking the "Enable advanced UI" checkbox on `/admin/config/media/media-library`. (This mitigation is not available in 8.7.x.)
Affected packages
| Package | Versions |
|---|---|
| Packagist · drupal/core | introduced 8.0.0, fixed 8.7.11 |
| Packagist · drupal/core | introduced 8.8.0, fixed 8.8.1 |
References
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-3.yaml WEB
- https://github.com/drupal/core PACKAGE
- https://www.drupal.org/sa-core-2019-011 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |