DRUPAL-CONTRIB-2021-022 This module provides a revision UI for Block Content entities.
Attackers with specific permissions can bypass access restrictions on Block Content entities when using this Drupal module with other affected modules.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2021-022?
DRUPAL-CONTRIB-2021-022 is a missing authorization vulnerability in drupal/block_content_revision_ui, published on 30 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
This module provides a revision UI for Block Content entities.
The module doesn't sufficiently respect access restrictions to certain entities when used in conjunction with specific modules.
This vulnerability is mitigated by the fact that an attacker must have a role with any of the permissions provided by Block Content Revision UI, and another affected module must be enabled.
Which versions are affected by DRUPAL-CONTRIB-2021-022?
Linux distribution packages (1)
drupal/block_content_revision_ui Packagist:https://packages.drupal.org/8 | All versions | 2.127.2 |
How do I fix DRUPAL-CONTRIB-2021-022?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2021-022 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2021-022 in the wild and no public exploit code.