GHSA-mh4h-27gq-cxwj
Drupal core Access bypass
En bref
- Publiée
- Mise à jour
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations. Solution: If you are using Drupal 8.7.x, you should upgrade to Drupal 8.7.11. If you are using Drupal 8.8.x, you should upgrade to Drupal 8.8.1. Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage. Alternatively, you may mitigate this vulnerability by unchecking the "Enable advanced UI" checkbox on `/admin/config/media/media-library`. (This mitigation is not available in 8.7.x.)
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · drupal/core | introduced 8.0.0, fixed 8.7.11 |
| Packagist · drupal/core | introduced 8.8.0, fixed 8.8.1 |
Références
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-3.yaml WEB
- https://github.com/drupal/core PACKAGE
- https://www.drupal.org/sa-core-2019-011 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |