DRUPAL-CONTRIB-2023-037 This module enables you to build administrative pages for managing configuration objects, which may then be used elsewhere in the site.
Insufficient access validation in a Drupal configuration module allows unauthorized users to manage configuration objects if JSONAPI is installed.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2023-037?
DRUPAL-CONTRIB-2023-037 is a missing authorization vulnerability in drupal/config_pages, published on 23 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
This module enables you to build administrative pages for managing configuration objects, which may then be used elsewhere in the site.
The module doesn't sufficiently validate access when the JSONAPI module is also installed.
This vulnerability is mitigated by the fact that it only affects sites when the JSONAPI module is installed.
Which versions are affected by DRUPAL-CONTRIB-2023-037?
Linux distribution packages (1)
drupal/config_pages Packagist:https://packages.drupal.org/8 | All versions | 2.9.0 |
How do I fix DRUPAL-CONTRIB-2023-037?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2023-037 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2023-037 in the wild and no public exploit code.