Description
The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.0, < 8.1.10 | 8.1.10 | GHSA-fmqh-2j2x-vgp3 |
| Packagist | drupal/drupal | >= 8.0, < 8.1.10 | 8.1.10 | GHSA-fmqh-2j2x-vgp3 |
References
- https://www.drupal.org/SA-CORE-2016-004
- 93101 vdb-entry
- 1036886 vdb-entry