DRUPAL-CONTRIB-2018-073 The Paragraphs module allows Drupal Site Builders to make content organization cleaner so that you can give more editing power to end-users.
Attackers with low privileges can bypass access controls to create unauthorized paragraph entities, potentially modifying content or escalating privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2018-073?
DRUPAL-CONTRIB-2018-073 is a missing authorization vulnerability in drupal/paragraphs, published on 31 Oct 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Paragraphs module allows Drupal Site Builders to make content organization cleaner so that you can give more editing power to end-users.
The module doesn't sufficiently check access to create new paragraph entities which can cause access bypass issues when used in combination with other contributed modules.
Which versions are affected by DRUPAL-CONTRIB-2018-073?
Linux distribution packages (1)
drupal/paragraphs Packagist:https://packages.drupal.org/8 | All versions | 1.5.0 |
How do I fix DRUPAL-CONTRIB-2018-073?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2018-073 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2018-073 in the wild and no public exploit code.