it-securitynotifies AT lists.piratenpartei.de
Betreff: Sicherheitsankündigungen
Listenarchiv
[IT-SecNots] [Security-news] Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030
Chronologisch Thread
- From: security-news AT drupal.org
- To: security-news AT drupal.org
- Subject: [IT-SecNots] [Security-news] Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030
- Date: Wed, 21 Aug 2024 17:07:26 +0000 (UTC)
- Dkim-filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org BC4A440AFB
- Dkim-filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org C4D256066F
- List-archive: <http://lists.drupal.org/pipermail/security-news/>
- List-id: <security-news.drupal.org>
View online: https://www.drupal.org/sa-contrib-2024-030
Project: Responsive and off-canvas menu [1]
Date: 2024-August-21
Security risk: *Moderately critical* 13∕25
AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2]
Vulnerability: Access bypass
Affected versions: <4.4.4
Description:
This module integrates the mmenu library with Drupal's menu system with the
aim of having an off-canvas mobile menu and a horizontal menu at wider
widths.
The module doesn't respect custom node access restrictions implemented
through hook_ENTITY_TYPE_access hooks meaning the titles of restricted nodes
can appear in the menu.
Only sites with modules that implement hook_ENTITY_TYPE_access to restrict
access to nodes are effected.
Solution:
Install the latest version:
* If you use the 4.x branch of the responsive_menu module upgrade to 4.4.4
[3]
Reported By:
* collinhaines [4]
Fixed By:
* Stephen Cox [5]
Coordinated By:
* Greg Knaddison [6] of the Drupal Security Team
* Juraj Nemec [7] of the Drupal Security Team
* Drew Webber [8] of the Drupal Security Team
[1] https://www.drupal.org/project/responsive_menu
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/responsive_menu/releases/4.4.4
[4] https://www.drupal.org/user/3532743
[5] https://www.drupal.org/user/2862323
[6] https://www.drupal.org/user/36762
[7] https://www.drupal.org/u/poker10
[8] https://www.drupal.org/u/mcdruid
_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news
- [IT-SecNots] [Security-news] Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030, security-news, 21.08.2024
Archiv bereitgestellt durch MHonArc 2.6.19+.