Drupal (SA-CORE-2019-008) Wordspaces Extension Access Bypass PoC

PenTestIT RSS Feed Last week, an advisory SA-CORE-2019-008 addressing a Drupal access bypass vulnerability was made public. MITRE assigned CVE-2019-6342 to this critical vulnerability. This is post to document the steps I took to create a PoC for SA-CORE-2019-008. Last such post on this blog was...

Drupal 8.7.4 Access Bypass Vulnerability (SA-CORE-2019-008) (drupal-2019-07-17)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.7.4. It is, therefore, affected by an access bypass condition when the experimental Workspaces module is enabled. Note this vulnerability does not affect any release other than Drupal 8.7.4. Drupa...

Drupal Access Bypass Vulnerability (SA-CORE-2019-008) - Windows

In Drupal 8.7.4, when the experimental Workspaces module is enabled, an access bypass condition is created. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Drupal Access Bypass Vulnerability (SA-CORE-2019-008) - Linux

In Drupal 8.7.4, when the experimental Workspaces module is enabled, an access bypass condition is created. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...