PT-2021-30997 · Packagist · Drupal/Social
Publicado
2021-01-27
·
Atualizado
2021-01-27
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
The optional Social Auth Extra module enables you to use the single sign-on methods provided by Open Social e.g. Facebook, LinkedIn, Google and Twitter.
The module doesn't implement a proper cache strategy for anonymous users allowing the registration form to be cached with disclosed information in certain scenarios. The information is usually only available for logged-in users of the community.
This vulnerability is mitigated by the fact that
social auth extra needs to be enabled, one of the single sign-on methods needs to be configured. There is no impact for regular registration without single sign-on.Removing the single sign-on providers from configuration will allow this vulnerability to be blocked.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Drupal/Social