SB2024012501 - Multiple vulnerabilities in Open Social module for Drupal

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: N/A)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the optional social_group_flexible_group module does not sufficiently validate group updates. A remote user can gain unauthorized access to sensitive information on the system.

2) Improper access control (CVE-ID: N/A)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can create public content even when this should not be allowed.

Remediation

Install update from vendor's website.

References

• https://www.drupal.org/sa-contrib-2024-005
• https://www.drupal.org/sa-contrib-2024-004