[IT-SecNots] [Security-news] Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2025-015

Project: Open Social [1]
Date: 2025-February-12
Security risk: *Less critical* 9 ∕ 25
AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass, Information Disclosure

Affected versions: <12.3.11 || >=12.4.0 <12.4.10
Description: 
Open Social is a Drupal distribution for online communities, which ships with
a default module to invite users to groups and events.

Invites for a specific user can be seen under certain conditions.

The issue is mitigated for events by the fact that social_event_max_enroll
has to be enabled.

Solution: 
Install the latest version:

 * If you use Open Social 12.3.x upgrade to Open Social 12.3.11 [3]
 * If you use Open Social 12.4.x upgrade to Open Social 12.4.10 [4]

Reported By: 
 * Robert Ragas (robertragas) [5]
 * zanvidmar [6]

Fixed By: 
 * Denis Kolmerschlag (uber_denis) [7]
 * zanvidmar [8]

Coordinated By: 
 * Greg Knaddison (greggles) [9] of the Drupal Security Team


[1] https://www.drupal.org/project/social
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/social/releases/12.3.11
[4] https://www.drupal.org/project/social/releases/12.4.10
[5] https://www.drupal.org/u/robertragas
[6] https://www.drupal.org/u/zanvidmar
[7] https://www.drupal.org/u/uber_denis
[8] https://www.drupal.org/u/zanvidmar
[9] https://www.drupal.org/u/greggles

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news