This module adds a tab for sufficiently permissioned users.
Impact
This module adds a tab for sufficiently permissioned users. The tab shows all revisions like standard Drupal but it also allows pretty viewing of all added/changed/deleted words between revisions.
Source excerpt · OSVThis vulnerability is mitigated by the fact that an attacker must have a role with the permission from the general node permission to "view all revisions", one of the more specific node type permissions, "view %bundle revisions" or the equivalent for other general entity types.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 1.8.0Ecosystem versions | 1.8.0 |
| From 2.0.0-beta1 before 2.0.0-beta3Ecosystem versions | 2.0.0-beta3 |
Version evidence: OSV · DRUPAL-CONTRIB-2024-042
View original version evidence (0 explicit versions)
Original source description
This module adds a tab for sufficiently permissioned users. The tab shows all revisions like standard Drupal but it also allows pretty viewing of all added/changed/deleted words between revisions.
The module doesn't sufficiently check revision access before rendering a diff report for 1) nodes or 2) general entities that support diff.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission from the general node permission to "view all revisions", one of the more specific node type permissions, "view %bundle revisions" or the equivalent for other general entity types.