DRUPAL-CONTRIB-2022-055 This module enables you to restrict content via taxonomy terms and related permissions.
An attacker can view restricted cached content if multiple entity types are enabled in the Drupal taxonomy restriction module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2022-055?
DRUPAL-CONTRIB-2022-055 is a missing authorization vulnerability in drupal/permissions_by_term, published on 7 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This module enables you to restrict content via taxonomy terms and related permissions.
The module doesn't sufficiently restrict cached content in certain circumstances.
This vulnerability is mitigated by the fact that it only occurs when multiple entity types are enabled in the module.
Which versions are affected by DRUPAL-CONTRIB-2022-055?
Linux distribution packages (1)
drupal/permissions_by_term Packagist:https://packages.drupal.org/8 | All versions | 3.1.19 |
How do I fix DRUPAL-CONTRIB-2022-055?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2022-055 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2022-055 in the wild and no public exploit code.