DRUPAL-CONTRIB-2022-014 This module enables users to create 'private' vocabularies.
Insufficient permission checks allow authenticated users to view, edit, or add terms to private vocabularies without proper authorization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2022-014?
DRUPAL-CONTRIB-2022-014 is a missing authorization vulnerability in drupal/private_taxonomy, published on 26 Jan 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
This module enables users to create 'private' vocabularies.
The module doesn't sufficiently check user access permissions when attempting to view, edit, or add terms to vocabularies, including vocabularies not managed by the module.
Partial mitigation is available by requiring users have been granted at least "Administer own taxonomy", "Edit own terms in vocabulary_name" or "Delete own terms in vocabulary_name" permissions, however this does not mitigate all known issues.
Which versions are affected by DRUPAL-CONTRIB-2022-014?
Linux distribution packages (1)
drupal/private_taxonomy Packagist:https://packages.drupal.org/8 | All versions | 2.5.0 |
How do I fix DRUPAL-CONTRIB-2022-014?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2022-014 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2022-014 in the wild and no public exploit code.