DRUPAL-CONTRIB-2018-018 This module helps in exporting and importing Menu Items via the administrative interface.
Anonymous users can export and import menu links due to missing access restrictions on administrative pages in this Drupal module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2018-018?
DRUPAL-CONTRIB-2018-018 is a missing authorization vulnerability in drupal/menu_export, published on 18 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This module helps in exporting and importing Menu Items via the administrative interface.
The module does not properly restrict access to administrative pages, allowing anonymous users to export and import menu links.
There is no mitigation for this vulnerability.
Which versions are affected by DRUPAL-CONTRIB-2018-018?
Linux distribution packages (1)
drupal/menu_export Packagist:https://packages.drupal.org/8 | All versions | 1.2.0 |
How do I fix DRUPAL-CONTRIB-2018-018?
No fix published yet.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2018-018 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2018-018 in the wild and no public exploit code.