Workbench Email - Moderately Critical - Access bypass - DRUPAL-SA-CONTRIB-2015-139

Workbench Email module provides a way for administrators to define email transitions and configurable email subject / messages between those transitions.

The module causes node and field validations to be skipped when saving nodes.

The vulnerability is mitigated by the fact that an attacker must have a role with permission to create or update nodes.

CVE identifier(s) issued

• CVE-2015-7230

Versions affected

• Workbench Email 7.x-3.x versions prior to 7.x-3.4

Drupal core is not affected. If you do not use the contributed Workbench Email module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Workbench Email module for Drupal 7.x, upgrade to Workbench Email 7.x-3.4

Also see the Workbench Email project page.

Reported by

• Yves Chedemois

Fixed by

• Brandon Tate the module maintainer

Coordinated by

• Pere orga of the Drupal Security Team