DRUPAL-CONTRIB-2018-071 This module enables you to resolve the provided Drupal path in order to find the canonical path and information about the resolved entity.
An attacker can view labels of inaccessible entities, such as unpublished content titles, due to insufficient access checks in the Drupal path resolver module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2018-071?
DRUPAL-CONTRIB-2018-071 is a vulnerability in drupal/decoupled_router, published on 31 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This module enables you to resolve the provided Drupal path in order to find the canonical path and information about the resolved entity. This information includes entity type ID, entity ID, entity UUID and entity label.
The module doesn't sufficiently check access before displaying entity labels. This leads to the display of labels on entities that are not be accessible, for example; titles of unpublished content.
Which versions are affected by DRUPAL-CONTRIB-2018-071?
Linux distribution packages (1)
drupal/decoupled_router Packagist:https://packages.drupal.org/8 | All versions | 1.2.0 |
How do I fix DRUPAL-CONTRIB-2018-071?
Apply the vendor's patch.
Is DRUPAL-CONTRIB-2018-071 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2018-071 in the wild and no public exploit code.