DRUPAL-CONTRIB-2022-023unknown
DRUPAL-CONTRIB-2022-023
No CVE assignedCheck your stack
The advisory, in context
This module enables you to manage and delete files.
The module doesn't sufficiently protect unmanaged files from view under the scenario unauthenticated user knows path to visit the view and can attempt to delete files which results in duplicate files being created.
To mitigate this issue without deploying code, review all views that are based on Fancy File Delete and ensure they have an access control set to use the permission "administer unmanaged files entities".
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/fancy_file_delete Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 2.0.7
Fixed in 2.0.7
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.7"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<2.0.7"
}
}
],
"versions": []
}