Description

Drupal Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to bypass certain security restrictions and perform otherwise restricted actions. Drupal Core version 8.8.0 is vulnerable.

Remediation

Update to Drupal Core version 8.8.1 or latest

References

https://www.drupal.org/sa-core-2019-011

Related Vulnerabilities

Omeka Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-26799)

Mailman Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2006-4624)

WordPress Plugin Download Manager Cross-Site Scripting (3.2.46)

WordPress Plugin Sendit WP Newsletter 'id' Parameter SQL Injection (2.1.0)

WordPress Plugin Weather Effect-Christmas Santa Snow Falling Cross-Site Scripting (1.3.5)

Severity

High

Classification

CWE-264 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass