PT-2021-30997 · Packagist · Drupal/Social
Published
2021-01-27
·
Updated
2021-01-27
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
The optional Social Auth Extra module enables you to use the single sign-on methods provided by Open Social e.g. Facebook, LinkedIn, Google and Twitter.
The module doesn't implement a proper cache strategy for anonymous users allowing the registration form to be cached with disclosed information in certain scenarios. The information is usually only available for logged-in users of the community.
This vulnerability is mitigated by the fact that
social auth extra needs to be enabled, one of the single sign-on methods needs to be configured. There is no impact for regular registration without single sign-on.Removing the single sign-on providers from configuration will allow this vulnerability to be blocked.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Drupal/Social