• Advisory ID: DRUPAL-SA-CONTRIB-2013-090
  • Project: Revisioning (third-party module)
  • Version: 7.x
  • Date: 2013-November-13
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

Description

This module enables you to create content publication workflows whereby one version of the content is "live" (publicly visible), while another is being edited and moderated privately until found fit for publication.
The module doesn't sufficiently apply node access permissions when used in combination with BOTH the Scheduler module AND a module that modifies the node access permissions table.

As a result it is possible that content that was Scheduled to be unpublished can still be viewed by authenticated users who, based on the node access table, should no longer have permission to view this content.

This vulnerability is mitigated by the fact that this only occurs for Authenticated users for Scheduled content on Drupal sites with the combination of all three modules: Revisioning, Scheduler and a module that modifies the node access table conditional on the publication status of the content. In this report this was the Organic Groups Moderation module.

CVE identifier(s) issued

  • CVE-2013-4597

Versions affected

  • Revisioning 7.x-1.x versions prior to 7.x-1.6

Drupal core is not affected. If you do not use the contributed Revisioning module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Revisioning project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.