DRUPAL-CONTRIB-2018-078 This module enables Drupal to synchronize entities with Salesforce records.
An attacker with low privileges can access a page exposing entity titles and IDs due to insufficient access controls in the Drupal Salesforce module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2018-078?
DRUPAL-CONTRIB-2018-078 is a missing authorization vulnerability in drupal/salesforce, published on 5 Dec 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
This module enables Drupal to synchronize entities with Salesforce records. The module includes a page that does not sufficiently protect access rights, resulting in potential information disclosure.
This vulnerability is mitigated by the fact that only Drupal entity title and IDs, and Salesforce record IDs are exposed. Entity content and metadata are appropriately protected. Disclosure of Salesforce ID does not confer any additional privileges.
Which versions are affected by DRUPAL-CONTRIB-2018-078?
Linux distribution packages (1)
drupal/salesforce Packagist:https://packages.drupal.org/8 | All versions | 3.1.0 |
How do I fix DRUPAL-CONTRIB-2018-078?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2018-078 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2018-078 in the wild and no public exploit code.