DRUPAL-CONTRIB-2019-014 Acquia Connector facilitates sending certain telemetry data to Acquia for the purposes of analysis.
An access control flaw in the Acquia Connector module allows attackers to disclose sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2019-014?
DRUPAL-CONTRIB-2019-014 is a missing authorization vulnerability in drupal/acquia_connector, published on 6 Feb 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Acquia Connector facilitates sending certain telemetry data to Acquia for the purposes of analysis. The module automates the collection of site information to speed support communication and issue resolution. It is required for use with the Acquia Insight service.
The module does not properly enforce access control in a specific case, which can lead to disclosing information.
The vulnerability is mitigated by requiring the module diff feature to be enabled. This feature is enabled by default.
Which versions are affected by DRUPAL-CONTRIB-2019-014?
Linux distribution packages (1)
drupal/acquia_connector Packagist:https://packages.drupal.org/8 | All versions | 1.16.0 |
How do I fix DRUPAL-CONTRIB-2019-014?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2019-014 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2019-014 in the wild and no public exploit code.