p PatchFirst

CVE-2019-6342

CVE-2019-6342 · Drupal core - Critical - Access bypass - SA-CORE-2019-008

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.

CVSS 9.8 · Critical · EPSS 2.2% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • drupal core

    Versions
    • Drupal 8 8.7.4: Affected

    No fix published

  • drupal/core Packagist

    Versions
    • 8.7.4
    Affected ranges
    • ECOSYSTEM: ≥ 8.7.4, < 8.7.5

    Update to 8.7.5

  • drupal/core Packagist

    Versions
    • 8.7.4
    Affected ranges
    • ECOSYSTEM: ≥ 8.7.4, < 8.7.5

    Update to 8.7.5

  • drupal7 Ubuntu:Pro:14.04:LTS

    Versions
    • 7.23-1
    • 7.24-1
    • 7.24-2
    • 7.26-1
    • 7.26-1ubuntu0.1
    • 7.26-1ubuntu0.1+esm1
    • 7.26-1ubuntu0.1+esm2
    • 7.26-1ubuntu0.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • drupal7 Ubuntu:Pro:16.04:LTS

    Versions
    • 7.38-1
    • 7.41-1
    • 7.44-1ubuntu1~16.04.0
    • 7.44-1ubuntu1~16.04.0+esm1
    • 7.44-1ubuntu1~16.04.0+esm2
    • 7.44-1ubuntu1~16.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →