DRUPAL-CONTRIB-2019-064 Forms Steps provides an UI to create form workflows using form modes.
An attacker with low privileges can view unauthorized workflow entities in the Forms Steps Drupal module due to insufficient permission checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2019-064?
DRUPAL-CONTRIB-2019-064 is a missing authorization vulnerability in drupal/forms_steps, published on 14 Aug 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Forms Steps provides an UI to create form workflows using form modes. It creates quick and configurable multisteps forms.
The module doesn't sufficiently check user permissions to access its workflows entities that allows to see any entities that have been created through the different steps of its multistep forms.
This vulnerability is mitigated by the fact that you have to know the Forms Steps URL to create a content linked to the flow. Also, all created content is very hard to edit through the same flow as you have to know the URL and the linked hash to the content.
Which versions are affected by DRUPAL-CONTRIB-2019-064?
Linux distribution packages (1)
drupal/forms_steps Packagist:https://packages.drupal.org/8 | All versions | 1.2.0 |
How do I fix DRUPAL-CONTRIB-2019-064?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2019-064 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2019-064 in the wild and no public exploit code.