DRUPAL-CONTRIB-2020-003 Views Bulk Operations provides enhancements to running bulk actions on views.
Authenticated users can bypass access controls to execute restricted views actions if custom action access hooks are used.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2020-003?
DRUPAL-CONTRIB-2020-003 is an authentication bypass vulnerability in drupal/views_bulk_operations, published on 5 Feb 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Views Bulk Operations provides enhancements to running bulk actions on views.
The module contains an access bypass vulnerability that might allow users to execute views actions that they should not have access to.
This vulnerability is mitigated by the fact that it only occurs in the case of customised action access (by means of hook_action_info_alter).
Which versions are affected by DRUPAL-CONTRIB-2020-003?
Linux distribution packages (1)
drupal/views_bulk_operations Packagist:https://packages.drupal.org/8 | All versions | 2.6.0, 3.4.0 |
How do I fix DRUPAL-CONTRIB-2020-003?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is DRUPAL-CONTRIB-2020-003 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2020-003 in the wild and no public exploit code.