PT-2019-20548 · Packagist · Drupal/Taxonomy Access Fix
Published
2019-12-11
·
Updated
2019-12-11
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
This module extends access handling of Drupal Core's Taxonomy module.
The module doesn't sufficiently check,
- if a given entity should be access controlled, defaulting to allowing access even to unpublished Taxonomy Terms.
- if certain administrative routes should be access controlled, defaulting to allowing access even to users without permission to access these administrative routes.
The vulnerability is mitigated by the facts, that
- the user interface to change the status of Taxonomy Terms has been released in Drupal Core 8.8 and a custom or contributed module is required in earlier versions of Drupal Core to mark Taxonomy Terms as unpublished.
- all entity operations (except the view operation) available on affected administrative routes still require appropriate permissions.
- an attacker must have a role with permission to either access content or view a Taxonomy Term in a vocabulary.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Drupal/Taxonomy Access Fix