- Advisory ID: DRUPAL-SA-CONTRIB-2017-042
- Project: Media (third-party module)
- Date: 12-Apr-2017
The Media module provides an extensible framework for managing files and multimedia assets, regardless of whether they are hosted on your own site or a 3rd party site - it is commonly referred to as a 'file browser to the internet'.
- Only the 1.x branch is affected. Version 2.0 does not have this vulnerability.
Drupal core is not affected. If you do not use the contributed Media module, there is nothing you need to do.
If you use the Media 1.x branch you should upgrade to version 2.0 or later.
See the Media 2.0 release notes for more information on how to upgrade (it's more complex than most contrib upgrades - for example, it involves other contrib modules moving from media_entity to file_entity)!
Also see the Media project page.
- Fabricio Bedoya
- Lee Rowlands
- Andrew Berry
- Matt Glaman
- Pieter Frenssen
- Andy Tawse
- Damian Robinson
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity