CVE-2016-7570: Drupal Users without "Administer comments" can set comment visibility on nodes they can edit
Summary
CVE-2016-7570: Drupal Users without "Administer comments" can set comment visibility on nodes they can edit. Affects drupal/drupal versions >= 8.0.0, < 8.1.10. Fixed in 8.1.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The vulnerability in question affects Drupal versions 8.x before 8.1.10. Drupal allows users to post comments on nodes (content items) within the system. However, the system does not properly check for the "Administer comments" permission, which allows remote authenticated users to manipulate the visibility of comments for arbitrary nodes by leveraging their rights to edit those nodes.
Vulnerability Detail
The vulnerability arises from the lack of proper permission checks in Drupal 8.x before 8.1.10. Remote authenticated users who do not have the "Administer comments" permission can exploit this flaw to modify the visibility of comments on nodes they have editing rights for. By setting the visibility of comments, an attacker can control the display of comments on arbitrary nodes, potentially affecting the user experience and content moderation within the Drupal system.
How To Fix
Minimum fixed version
8.1.10
This is the first release that contains the fix.
composer require drupal/drupal:8.1.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Drupal is not immediately feasible, a temporary workaround can be implemented by manually checking and adjusting the comment visibility settings for affected nodes. This can be done by users with the necessary permissions to edit nodes and manage comments. By reviewing and updating the comment visibility settings, the impact of the vulnerability can be mitigated until a proper upgrade can be performed.
Conclusion
In conclusion, the vulnerability in Drupal versions 8.x before 8.1.10 allows remote authenticated users to manipulate comment visibility on arbitrary nodes. Upgrading to the latest version of Drupal or implementing a temporary workaround can mitigate the impact of this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/drupal →
FAQ
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications.
The vulnerability affects Drupal versions 8.x before 8.1.10.
The vulnerability allows remote authenticated users to manipulate the visibility of comments on arbitrary nodes, potentially affecting the user experience and content moderation within the Drupal system.
To fix this vulnerability, it is recommended to upgrade to Drupal version 8.1.10 or later.
If upgrading to the latest version of Drupal is not immediately feasible, a temporary workaround can be implemented by manually adjusting the comment visibility settings for affected nodes.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/drupal.
