DRUPAL-CONTRIB-2022-023 This module enables you to manage and delete files.
Unauthenticated users can delete unmanaged files if views lack proper access control, leading to data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2022-023?
DRUPAL-CONTRIB-2022-023 is a missing authorization vulnerability in drupal/fancy_file_delete, published on 9 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This module enables you to manage and delete files.
The module doesn't sufficiently protect unmanaged files from view under the scenario unauthenticated user knows path to visit the view and can attempt to delete files which results in duplicate files being created.
To mitigate this issue without deploying code, review all views that are based on Fancy File Delete and ensure they have an access control set to use the permission "administer unmanaged files entities".
Which versions are affected by DRUPAL-CONTRIB-2022-023?
Linux distribution packages (1)
drupal/fancy_file_delete Packagist:https://packages.drupal.org/8 | All versions | 2.0.7 |
How do I fix DRUPAL-CONTRIB-2022-023?
Change a configuration setting.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2022-023 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2022-023 in the wild and no public exploit code.