Improper authorization control for web services In drupal/core
Description
Drupal Unprivileged access to config export The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 8.1.10 | ||
packagist | 8.1.10 |
Aliases
1. 2. 3. 4.
References
1. 2. 3. 4. 5.