DRUPAL-CONTRIB-2021-041 This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.
An attacker with admin permissions can view blocks they lack permission to access, leading to unauthorized data disclosure.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2021-041?
DRUPAL-CONTRIB-2021-041 is a missing authorization vulnerability in drupal/tb_megamenu, published on 22 Sep 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.
This module has a vulnerability whereby users can select blocks as a menu item they don't have permission to view.
The vulnerability is mitigated by the fact that it can only be exploited by an attacker with the "Administer TB Mega Menu" permission.
Which versions are affected by DRUPAL-CONTRIB-2021-041?
Linux distribution packages (1)
drupal/tb_megamenu Packagist:https://packages.drupal.org/8 | All versions | 1.4.0 |
How do I fix DRUPAL-CONTRIB-2021-041?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2021-041 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2021-041 in the wild and no public exploit code.