PT-2019-20411 · Packagist · Drupal/Social
Published
2019-11-06
·
Updated
2019-11-06
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Open Social is a Drupal distribution for online communities. The included social magic login module doesn't sufficiently validate magic login URLs for user accounts that do not have a local password, but login via external systems. The lack of validation makes it possible for an adversary to forge valid login URLs and login to such an account.
This vulnerability is mitigated by the fact the module social magic login needs to be enabled.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Drupal/Social