Zum Inhalt springen.
Sympa Menü

it-securitynotifies - [IT-SecNots] [Security-news] Booking and Availability Management Tools for Drupal - Moderately critical - Access Bypass - SA-CONTRIB-2019-074

it-securitynotifies AT lists.piratenpartei.de

Betreff: Sicherheitsankündigungen

Listenarchiv

[IT-SecNots] [Security-news] Booking and Availability Management Tools for Drupal - Moderately critical - Access Bypass - SA-CONTRIB-2019-074


Chronologisch Thread 
  • From: security-news AT drupal.org
  • To: security-news AT drupal.org
  • Subject: [IT-SecNots] [Security-news] Booking and Availability Management Tools for Drupal - Moderately critical - Access Bypass - SA-CONTRIB-2019-074
  • Date: Wed, 16 Oct 2019 16:27:46 +0000 (UTC)
  • List-archive: <http://lists.drupal.org/pipermail/security-news/>
  • List-id: <security-news.drupal.org>

View online: https://www.drupal.org/sa-contrib-2019-074

Project: Booking and Availability Management Tools for Drupal [1]
Date: 2019-October-16
Security risk: *Moderately critical* 11∕25
AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2]
Vulnerability: Access Bypass

Description: 
The Bat module provides a foundation through which a wide range of
availability management, reservation and booking use cases can be addressed.

The routes used to view events don't sufficiently guard access for
non-privileged users. Specifically, a user with the 'View own' permission for
bat events can view others' events as well.

Solution: 
Install the latest version:

* If you use the bat module for Drupal 8.x, upgrade to bat 8.x-1.2 [3]

Also see the Booking and Availability Management Tools for Drupal [4] project
page.

Reported By: 
* Jelle Sebreghts [5]

Fixed By: 
* Adrian Rollett [6]
* Lee Rowlands [7] of the Drupal Security Team
* Jelle Sebreghts [8]

Coordinated By: 
* Greg Knaddison [9] of the Drupal Security Team


[1] https://www.drupal.org/project/bat
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/bat/releases/8.x-1.2
[4] https://www.drupal.org/project/bat
[5] https://www.drupal.org/user/829198
[6] https://www.drupal.org/user/253909
[7] https://www.drupal.org/user/395439
[8] https://www.drupal.org/user/829198
[9] https://www.drupal.org/user/36762

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news


  • [IT-SecNots] [Security-news] Booking and Availability Management Tools for Drupal - Moderately critical - Access Bypass - SA-CONTRIB-2019-074, security-news, 16.10.2019

Archiv bereitgestellt durch MHonArc 2.6.19.

Seitenanfang