The AltaGrade Blog

Project: Drupal core
Date: 2023-April-19
Security risk: Moderately critical 13∕25 
Vulnerability: Access bypass

Description

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to.

Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.

Project: Drupal core
Date: 2023-March-15
Security risk: Moderately critical 14∕25
Vulnerability: Information Disclosure
Affected versions: >=8.0.0 =9.5.0 =10.0.0 

Description

The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files.

As a content management system, Drupal is widely used by organizations of all sizes to create and manage websites. Drupal 10 is the latest version of the platform, and it offers a number of benefits over earlier versions. Here at AltaGrade, we are highly knowledgeable Drupal specialists and we can help you upgrade your website to Drupal 10.

Project: Private Taxonomy Terms
Date: 2023-January-11
Security risk: Moderately critical 10∕25
Vulnerability: Access bypass

Description

This module enables users to create 'private' vocabularies.

The module doesn't enforce permissions appropriately for the taxonomy overview page and overview form.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer own taxonomy" or "View private taxonomies"

Solution