Access Restriction Bypass Affecting drupal/workbench_moderation package, versions >=1.0.0, <1.4.0
Snyk CVSS
Attack Complexity
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-DRUPALWORKBENCHMODERATION-174742
- published 21 May 2019
- disclosed 22 Feb 2019
- credit Unknown
How to fix?
Upgrade drupal/workbench_moderation to version 1.4.0 or higher.
Overview
drupal/workbench_moderation provides basic moderation support for revisionable content entities.
Affected versions of this package are vulnerable to Access Restriction Bypass. It adds arbitrary moderation states to Drupal core's "unpublished" and "published" node states, and affects the behavior of node revisions when nodes are published.
In some conditions, content moderation fails to check a users access to use certain transitions, leading to an access bypass.