[IT-SecNots] [Security-news] Open Social - Moderately critical - Access bypass - SA-CONTRIB-2022-061

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2022-061

Project: Open Social [1]
Date: 2022-November-30
Security risk: *Moderately critical* 13∕25
AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2]
Vulnerability: Access bypass

Affected versions: >=11.4.0 <11.4.9 || >=11.5.0 <11.5.1
Description: 
Social Flexible Group is an Open Social extension that allows users to create
groups with many different configurations.

In specific uncommon scenarios, where a platform doesn't have any flexible
groups with the "Group members only (secret)" visibility, community groups
are visible to anonymous users on the /all-groups page. No other group
information is revealed since group access is not affected by this issue.

This vulnerability is mitigated by creating a Flexible Group with visibility
"Group members only (secret)".

Solution: 
Install the latest version:

  * If you use the Open Social distribution for Drupal 9.x, upgrade to Open
    Social 11.5.1 [3]
  * If you use the Open Social distribution for Drupal 9.x, upgrade to Open
    Social 11.4.9 [4]

Reported By: 
  * Tiago Siqueira [5]

Fixed By: 
  * Tiago Siqueira [6]
  * Alexander Varwijk [7]
  * Navneet Singh [8]

Coordinated By: 
  * cilefen [9] of the Drupal Security Team
  * Damien McKenna [10] of the Drupal Security Team
  * Greg Knaddison [11] of the Drupal Security Team


[1] https://www.drupal.org/project/social
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/social/releases/11.5.1
[4] https://www.drupal.org/project/social/releases/11.4.9
[5] https://www.drupal.org/user/2822445
[6] https://www.drupal.org/user/2822445
[7] https://www.drupal.org/user/1868952
[8] https://www.drupal.org/user/3200545
[9] https://www.drupal.org/user/1850070
[10] https://www.drupal.org/user/108450
[11] https://www.drupal.org/user/36762

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news