[IT-SecNots] [Security-news] Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2024-022

Project: Drupal REST & JSON API Authentication [1]
Date: 2024-May-29
Security risk: *Moderately critical* 11∕25
AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Affected versions: <2.0.13
Description: 
Drupal REST & JSON API Authentication module restricts and secures
unauthorized access to your Drupal site APIs using different authentication
methods including Basic Authentication , API Key Authentication , JWT
Authentication , OAuth Authentication , External / Third-Party Provider
Authentication, etc.

The module doesn't sufficiently control user access when using Basic
Authentication.

Solution: 
Install the latest version:

  * If you use the 2.0.x branch, upgrade to Drupal REST & JSON API
    Authentication 2.0.13 [3]
  * If you use the 8.x-1.x branch, upgrade to Drupal REST & JSON API
    Authentication 2.0.13 [4], as the 8.x-1.x branch is now unsupported.

Reported By: 
  * Arek Suchecki [5]

Fixed By: 
  * solideogloria [6]
  * Shashank Thigale [7]
  * Arek Suchecki [8]
  * Greg Knaddison [9] of the Drupal Security Team

Coordinated By: 
  * Greg Knaddison [10] of the Drupal Security Team
  * Juraj Nemec [11] of the Drupal Security Team
  * David Rothstein [12] of the Drupal Security Team


[1] https://www.drupal.org/project/rest_api_authentication
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/rest_api_authentication/releases/2.0.13
[4] https://www.drupal.org/project/rest_api_authentication/releases/2.0.13
[5] https://www.drupal.org/user/3553379
[6] https://www.drupal.org/user/3589277
[7] https://www.drupal.org/user/3632808
[8] https://www.drupal.org/user/3553379
[9] https://www.drupal.org/user/36762
[10] https://www.drupal.org/user/36762
[11] https://www.drupal.org/user/272316
[12] https://www.drupal.org/user/124982

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news