[IT-SecNots] [Security-news] Modal Form - Critical - Access bypass - SA-CONTRIB-2020-029

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2020-029

Project: Modal Form [1]
Version: 8.x-1.x-dev
Date: 2020-July-22
Security risk: *Critical* 16∕25
AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Description: 
The Modal form module is a toolset for quick start of using forms in modal
windows.

Any form is available for view and submit when the modal_form module is
installed. The only requirement is to know the form's fully-qualified class
name.

Solution: 
Upgrade to modal_form-8.x-1.2 [3].

Also see the Modal Form [4] project page.

Reported By: 
  * Dave Long  [5]

Fixed By: 
  * Sergii Bondarenko  [6]

Coordinated By: 
  * Greg Knaddison [7] of the Drupal Security Team


[1] https://www.drupal.org/project/modal_form
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/modal_form/releases/8.x-1.2
[4] https://www.drupal.org/project/modal_form
[5] https://www.drupal.org/user/246492
[6] https://www.drupal.org/user/2802285
[7] https://www.drupal.org/user/36762

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news