CVE-2019-6342 Drupal core - Critical - Access bypass - SA-CORE-2019-008
Attackers can bypass access controls when the experimental Workspaces module is enabled in Drupal 8 core.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-6342?
CVE-2019-6342 is a critical authentication bypass vulnerability in Drupal Drupal, published on 28 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.
Which versions are affected by CVE-2019-6342?
2 open source packages ship an affected version, including drupal/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal/core Packagist | From 8.7.4 | 8.7.5 |
drupal/core Packagist | From 8.7.4 | 8.7.5 |
Products include Drupal Drupal.
How do I fix CVE-2019-6342?
Upgrade drupal/core to 8.7.5 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-6342 being exploited?
There is no known exploitation of CVE-2019-6342 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as DRUPAL-CORE-2019-008, GHSA-xq62-62c9-22mg, UBUNTU-CVE-2019-6342.