[IT-SecNots] [Security-news] Views - Moderately critical - Information disclosure - SA-CONTRIB-2019-035

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2019-035

Project: Views [1]
Version: 7.x-3.x-dev
Date: 2019-March-13
Security risk: *Moderately critical* 10∕25
AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2]
Vulnerability: Information disclosure

Description: 
This module enables you to create customized lists of data.

The module doesn't sufficiently build queries when used with exposed filters,
leading to a possible information disclosure vulnerability in certain rare
circumstances.

This vulnerability is mitigated by the fact that a view must have an exposed
filter on a field that is used on multiple entity types, both of which are
included in the view.

Solution: 
Install the latest version:

  * If you use the Views module for Drupal 7.x, upgrade to Views 7.x-3.21 [3]

Also see the Views [4] project page.

Reported By: 
  * Lucas Hedding  [5]

Fixed By: 
  * Klaus Purer  [6]
  * Lucas Hedding  [7]
  * Greg Knaddison  [8] of the Drupal Security Team
  * Aaron Zinck  [9]
  * Daniel Wehner  [10]
  * Damien McKenna  [11] of the Drupal Security Team
  * Vijaya Chandran Mani  [12]

Coordinated By: 
  * Damien McKenna [13] of the Drupal Security Team.

-------- ADDITIONAL INFORMATION
----------------------------------------------

Note: Drupal issues individual security advisories for separate
vulnerabilities included in a release, rather than lumping "multiple
vulnerabilities" into a single advisory. All advisories released today for
Views:

  * SA-CONTRIB-2019-034 [14]
  * SA-CONTRIB-2019-035 [15]
  * SA-CONTRIB-2019-036 [16]


[1] https://www.drupal.org/project/views
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/views/releases/7.x-3.21
[4] https://www.drupal.org/project/views
[5] https://www.drupal.org/user/1463982
[6] https://www.drupal.org/user/262198
[7] https://www.drupal.org/user/1463982
[8] https://www.drupal.org/user/36762
[9] https://www.drupal.org/user/518662
[10] https://www.drupal.org/user/99340
[11] https://www.drupal.org/user/108450
[12] https://www.drupal.org/user/93488
[13] https://www.drupal.org/u/damienmckenna
[14] https://www.drupal.org/sa-contrib-2019-034
[15] https://www.drupal.org/sa-contrib-2019-035
[16] https://www.drupal.org/sa-contrib-2019-036

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news