This module extends access handling of Drupal Core's Taxonomy module.
Impact
This module extends access handling of Drupal Core's Taxonomy module.
Source excerpt · OSVThe vulnerability is mitigated by the facts, that * all entity operations (except the view operation) available on affected administrative routes still require appropriate permissions. * an attacker must have a role with permission to either access content or view a Taxonomy Term in a vocabulary.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 2.7.0Ecosystem versions | 2.7.0 |
Version evidence: OSV · DRUPAL-CONTRIB-2019-093
View original version evidence (0 explicit versions)
Original source description
This module extends access handling of Drupal Core's Taxonomy module.
The module doesn't sufficiently check,
- if a given entity should be access controlled, defaulting to allowing access even to unpublished Taxonomy Terms.
- if certain administrative routes should be access controlled, defaulting to allowing access even to users without permission to access these administrative routes.
The vulnerability is mitigated by the facts, that
- the user interface to change the status of Taxonomy Terms has been released in Drupal Core 8.8 and a custom or contributed module is required in earlier versions of Drupal Core to mark Taxonomy Terms as unpublished.
- all entity operations (except the view operation) available on affected administrative routes still require appropriate permissions.
- an attacker must have a role with permission to either access content or view a Taxonomy Term in a vocabulary.