[IT-SecNots] [Security-news] Simple AMP (Accelerated Mobile Pages) - Moderately critical - Access bypass - SA-CONTRIB-2019-071

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2019-071

Project: Simple AMP (Accelerated Mobile Pages) [1]
Date: 2019-October-02
Security risk: *Moderately critical* 13∕25
AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Description: 
This module allows display of a site's content in AMP format.

The module doesn't sufficiently check access on unpublished or restricted
content.

Solution: 
Install the latest version of the module.

  * If you use the Simple AMP module for Drupal 8.x, upgrade to Simple AMP
    8.x-1.16 [3]

Also see the Simple AMP (Accelerated Mobile Pages) [4] project page.

Reported By: 
  * M. H.  [5]

Fixed By: 
  * Minnur Yunusov  [6]
  * M. H.  [7]

Coordinated By: 
  * Damien McKenna [8] of the Drupal Security Team


[1] https://www.drupal.org/project/simple_amp
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/simple_amp/releases/8.x-1.16
[4] https://www.drupal.org/project/simple_amp
[5] https://www.drupal.org/user/3054025
[6] https://www.drupal.org/user/702026
[7] https://www.drupal.org/user/3054025
[8] https://www.drupal.org/u/damienmckenna

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news