Drupal core Access bypass in Media Library module
Summary
GHSA-mh4h-27gq-cxwj: Drupal core Access bypass. Affects drupal/core across 2 version ranges.
>= 8.0.0, < 8.7.11
>= 8.8.0, < 8.8.1
Fixed in 8.7.11 or 8.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal core is a content management system (CMS) that allows users to easily create and manage websites. The Media Library module is a part of Drupal core and provides a way to manage media items such as images, videos, and documents. This module allows users to upload, organize, and display media files on their Drupal websites.
Vulnerability Detail
The Media Library module in Drupal core has a security vulnerability that can lead to access bypass. In certain configurations, the module does not sufficiently restrict access to media items, allowing unauthorized users to view or modify them. This vulnerability can potentially lead to unauthorized access to sensitive media files and compromise the security of the Drupal website.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.118.7.11composer require drupal/core:8.7.11 -
>= 8.8.0, < 8.8.18.8.1composer require drupal/core:8.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Alternatively, you can mitigate this vulnerability by unchecking the "Enable advanced UI" checkbox on the "admin/config/media/media-library" page. Please note that this mitigation is not available in Drupal 8.7.x.
Conclusion
The Drupal core Media Library module has a vulnerability that can lead to access bypass. It is crucial to upgrade to the latest version of Drupal core or apply the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
This vulnerability can allow unauthorized users to access and modify media items on a Drupal website, potentially leading to data breaches or unauthorized disclosure of sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your Drupal website is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this advisory, there are no known exploits for this vulnerability. However, it is important to patch your Drupal installation as soon as possible to prevent any potential exploitation.
While applying the workaround can help mitigate the vulnerability, it is still recommended to upgrade Drupal to the latest version. Upgrading ensures that you have the most secure and up-to-date version of Drupal core, with all the necessary patches and bug fixes.
Yes, you can find more details about this vulnerability, including the specific versions affected and fixed, in the advisory on the GitHub Advisory Database. The link to the advisory is provided in the 'database_specific' field of this vulnerability report.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
