PT-2024-40106 · Drupal · Drupal

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Drupal versions prior to 8.7.11 Drupal versions 8.8.x prior to 8.8.1

Description: The Media Library module has a security issue where it does not sufficiently restrict access to media items in certain configurations.

Recommendations: If you are using Drupal 8.7.x, upgrade to Drupal 8.7.11. If you are using Drupal 8.8.x, upgrade to Drupal 8.8.1. For versions prior to 8.7.x, no official solution is available as they are end-of-life. As a temporary workaround for versions other than 8.7.x, consider unchecking the "Enable advanced UI" checkbox on "/admin/config/media/media-library" to mitigate this issue.

Fix

Related Identifiers

GHSA-5X28-3F32-X523

Affected Products

Drupal

References · 4

• https://osv.dev/vulnerability/GHSA-5x28-3f32-x523 · Vendor Advisory
• https://github.com/drupal/drupal · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2019-12-18-3.yaml · Note
• https://drupal.org/sa-core-2019-011 · Note