GitHub Advisoryadvisory · Packagist

GHSA-6g9h-6v79-w4pc Drupal Users without "Administer comments" can set comment visibility on nodes they can edit

MEDIUM Published 2022-05-17 Modified 2024-04-23 Official page ↗
Aliases
CVE-2016-7570
Ecosystem
Packagist
Packages
drupal/drupal, drupal/core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-269
Reviewed
2024-04-23

Affected packages

• Packagist drupal/drupal: >= 8.0.0, < 8.1.10 → fixed in 8.1.10 • Packagist drupal/core: >= 8.0.0, < 8.1.10 → fixed in 8.1.10

Description

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.

Related

Alias · CVE (1)

  • CVE-2016-7570 Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the… vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References