Project:
Date:
2019-July-10
Vulnerability:
Access bypass
Affected versions:
<1.2.0
Description:
This module enables you to add and manage additional custom permissions through the administration UI.
The module doesn't sufficiently check for the proper access permissions to this page.
This vulnerability is mitigated by the fact that an attacker must know the route of the Custom Permissions administration form though this is easily known.
Solution:
Install the latest version:
- If you use the Custom Permissions 8.x-1.1 for Drupal 8.x, upgrade to Custom Permissions 8.x-1.2
Also see the Custom Permissions project page.
Reported By:
Fixed By:
Coordinated By:
- Greg Knaddison of the Drupal Security Team
