DRUPAL-CONTRIB-2020-033 - The Group module enables you to hand out permissions on a smaller subset, section or…

Severity: info · Published 2020-08-05

The Group module enables you to hand out permissions on a smaller subset, section or community of your website.

Under very specific circumstances, where two group types support the same content, yet hand out different permissions, non-members of the first group type may use the set of permissions of the 2nd group type for the grouped content.

This vulnerability is mitigated by the fact that you must already have a rare set-up and the two group types are configured in a way where one is more permissive than the other over the same type of content.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Group. Vendors: Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Informational severity, published 5 August 2020.
Which products and versions are affected?
Packagist:Https://Packages.Drupal.Org/8 Drupal/Group ECOSYSTEM:introduced=0,fixed=1.2.0.
Is there a fix for This vulnerability?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Group: upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected?
Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Group at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Group: upgrade to 1.2.0 or later

Affected products

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Group ECOSYSTEM:introduced=0,fixed=1.2.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.