DRUPAL-CONTRIB-2021-016 This module provides a revision UI to Linky entities.
Authenticated users with specific Linky permissions can bypass access restrictions to view or modify entities when combined with other modules.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2021-016?
DRUPAL-CONTRIB-2021-016 is a missing authorization vulnerability in drupal/linky_revision_ui, published on 16 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
This module provides a revision UI to Linky entities.
The module doesn't sufficiently respect access restrictions to certain entities when used in conjunction with specific modules.
This vulnerability is mitigated by the fact that an attacker must have a role with any of the permissions provided by Linky Revision UI, and another affected module must be enabled.
Which versions are affected by DRUPAL-CONTRIB-2021-016?
Linux distribution packages (1)
drupal/linky_revision_ui Packagist:https://packages.drupal.org/8 | All versions | 2.127.1 |
How do I fix DRUPAL-CONTRIB-2021-016?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2021-016 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2021-016 in the wild and no public exploit code.