Missing Authorization in Drupal
Published 10 Oct 2019 · Updated 16 Feb 2024
Affected packages
- Affected
- >=8.0 <8.3.7
- Fixed in
- 8.3.7
composer require drupal/core:^8.3.7- Affected
- >=8.0 <8.3.7
- Fixed in
- 8.3.7
composer require drupal/drupal:^8.3.7Details
In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.
Is GHSA-v3f6-f29f-rgvp in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected drupal/core, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2017-6923
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6923.yaml
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6923.yaml
- Linkwww.drupal.org/SA-CORE-2017-004
- Linkwww.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple
- Linkwww.securityfocus.com/bid/100368
- Linkwww.securitytracker.com/id/1039200
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.