Project: Services
Version: 7.x-3.x-dev
Date: 2019-April-03
Security risk: Less critical 9∕25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: Access bypass
Description:
This module provides a standardized solution for building API's so that external clients can communicate with Drupal.
The Services module has an access bypass vulnerability in its "attach_file" resource that allows users who have access to create or update nodes that include file fields to arbitrarily reference files they do not have access to, which can expose private files.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit a node.
https://www.drupal.org/sa-contrib-2019-043
Project: Services Version: 7.x-3.x-dev Date: 2019-April-03 Security risk: Less critical 9∕25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Access bypass Description: This module provides a standardized solution for building API's so that external clients can communicate with Drupal.
The Services module has an access bypass vulnerability in its "attach_file" resource that allows users who have access to create or update nodes that include file fields to arbitrarily reference files they do not have access to, which can expose private files.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit a node.
Solution: Install the latest version: