—

DRUPAL-CONTRIB-2019-013

Details

This module provides a field on user profiles which allows users to get a notification when their account logs in to the site. The notification e-mail includes a link which will terminate all sessions for that user. This is useful in the case of unauthorised access to the account.

The module doesn't employ sufficient randomness in the generation of URLs, which represents an Access Bypass vulnerability.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist:https://packages.drupal.org/8/drupal/login_alert

Introduced in: 0Fixed in: 1.3.0

Upgrade drupal/login_alert to 1.3.0 or newer (ecosystem packagist:https://packages.drupal.org/8).

References

https://www.drupal.org/sa-contrib-2019-013[WEB]