SA-CONTRIB-2013-090 - Revisioning - Access Bypass

This module enables you to create content publication workflows whereby one version of the content is “live” (publicly visible), while another is being edited and moderated privately until found fit for publication.
The module doesn’t sufficiently apply node access permissions when used in combination with BOTH the Scheduler module AND a module that modifies the node access permissions table.

As a result it is possible that content that was Scheduled to be unpublished can still be viewed by authenticated users who, based on the node access table, should no longer have permission to view this content.

This vulnerability is mitigated by the fact that this only occurs for Authenticated users for Scheduled content on Drupal sites with the combination of all three modules: Revisioning, Scheduler and a module that modifies the node access table conditional on the publication status of the content. In this report this was the Organic Groups Moderation module.

CVE identifier(s) issued

• CVE-2013-4597

Versions affected

• Revisioning 7.x-1.x versions prior to 7.x-1.6

Drupal core is not affected. If you do not use the contributed Revisioning module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Revisioning module, version 7.x-1.5 or older, upgrade to Revisioning 7.x-1.6

Also see the Revisioning project page.

Reported by

• Pete Gillis

Fixed by

• Rik de Boer, the module maintainer, with assistance from Pete Gillis

Coordinated by

• Greg Knaddison of the Drupal Security Team