DRUPAL-CONTRIB-2019-048 This module enables you to use special routes for user registration with special roles and custom field sets defined for the role.
Attackers can register as administrators by bypassing role checks, leading to full site compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2019-048?
DRUPAL-CONTRIB-2019-048 is a vulnerability in drupal/multiple_registration, published on 15 May 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
This module enables you to use special routes for user registration with special roles and custom field sets defined for the role.
The module doesn't sufficiently check which user roles can be registered under the scenario when the user tries to register the user with the administrator role.
This vulnerability is mitigated on sites where account approval is required as the user starts as blocked but still gets the "Administrator" role.
Which versions are affected by DRUPAL-CONTRIB-2019-048?
Linux distribution packages (1)
drupal/multiple_registration Packagist:https://packages.drupal.org/8 | All versions | 2.8.0 |
How do I fix DRUPAL-CONTRIB-2019-048?
Apply the vendor's patch.
Is DRUPAL-CONTRIB-2019-048 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2019-048 in the wild and no public exploit code.