PT-2024-40374 · Drupal · Drupal

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 8.7.11 Drupal versions 8.8.x prior to 8.8.1

Description The Media Library module has a security issue where it does not sufficiently restrict access to media items in certain configurations.

Recommendations If you are using Drupal 8.7.x, upgrade to Drupal 8.7.11. If you are using Drupal 8.8.x, upgrade to Drupal 8.8.1. For versions prior to 8.7.x, no solution is available as they are end-of-life. As a temporary workaround for versions 8.8.x, consider unchecking the "Enable advanced UI" checkbox on "/admin/config/media/media-library".

Fix

Related Identifiers

GHSA-MH4H-27GQ-CXWJ

Affected Products

Drupal

References · 4

• https://osv.dev/vulnerability/GHSA-mh4h-27gq-cxwj · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-3.yaml · Note
• https://github.com/drupal/core · Note
• https://drupal.org/sa-core-2019-011 · Note