CVE-2019-6342: Drupal Core - Improper Access Control
Summary
CVE-2019-6342: Drupal Improper Access Control. Affects drupal/core versions >= 8.7.4, < 8.7.5. Fixed in 8.7.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible framework for building websites and applications. The Drupal core package is the foundation of the CMS and includes essential features and functionality. The Workspaces module, an experimental feature in Drupal 8 core, allows users to create and manage multiple workspaces for content staging and previewing. However, a vulnerability exists in the Workspaces module in Drupal 8.7.4, which can lead to improper access control.
Vulnerability Detail
The access bypass vulnerability in the Workspaces module of Drupal 8.7.4 allows unauthorized users to bypass access restrictions and gain unauthorized access to content. This vulnerability can be exploited by enabling the Workspaces module. It affects only Drupal 8.7.4 and does not impact any other releases. The vulnerability has a CVSS score of 9.8, indicating its critical severity. Exploiting this vulnerability can result in unauthorized modification, disclosure, or destruction of sensitive data.
How To Fix
Minimum fixed version
8.7.5
This is the first release that contains the fix.
composer require drupal/core:8.7.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if disabling the Workspaces module is not feasible, it is recommended to restrict access to the module by implementing custom access controls. This can be achieved by modifying the module's code or using Drupal's access control mechanisms to limit access to trusted users or roles. However, it is strongly advised to follow the official fix by disabling the module and updating Drupal to ensure comprehensive security.
Conclusion
The access bypass vulnerability in the Workspaces module of Drupal 8.7.4 poses a critical security risk as it allows unauthorized access to sensitive content. To mitigate this vulnerability, it is crucial to disable the Workspaces module and update Drupal to the latest version. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible framework for building websites and applications.
The Workspaces module is an experimental feature in Drupal 8 core that allows users to create and manage multiple workspaces for content staging and previewing.
Only Drupal 8.7.4 is affected by this vulnerability. Other releases are not impacted.
Exploiting this vulnerability can lead to unauthorized modification, disclosure, or destruction of sensitive data.
To fix this vulnerability, disable the Workspaces module in Drupal 8.7.4 and update Drupal to version 8.7.5 or higher.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
