Dynamic display block - Less Critical - Access bypass - SA-CONTRIB-2015-104

This module enables you to showcase featured content at a prominent place on the front page of the site in an attractive way.

The module doesn’t sufficiently protect access to content a user has no access to. In certain scenarios a user with the “administer ddblock” permission can see titles of content for which this user has no access.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer ddblock” permission.

CVE identifier(s) issued

• CVE-2015-5491

Versions affected

• Dynamic display block 7.x-1.x versions prior to 7.x-1.1

Solution

• If you use the Dynamic display block module for Drupal 7.x, upgrade to Dynamic display block 7.x-1.1

Also see the Dynamic display block project page.

Reported by

• David Rothstein of the Drupal Security Team

Fixed by

• David Rothstein of the Drupal Security Team
• Philip Blaauw the module maintainer

Coordinated by

• Ben Dougherty of the Drupal Security Team
• Pere Orga of the Drupal Security Team