Description
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Drupal | Drupal Core | 8.2.x versions before 8.2.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.2.0, < 8.2.7 | 8.2.7 | GHSA-w7qx-vwr9-2j3r |
| Packagist | drupal/drupal | >= 8.2.0, < 8.2.7 | 8.2.7 | GHSA-w7qx-vwr9-2j3r |
References
- 1038058 vdb-entry
- https://www.drupal.org/SA-2017-001
- 96919 vdb-entry