—

DRUPAL-CONTRIB-2021-037

Details

This module enables sites to define a domain from Domain Access that points directly to a group page.

The module doesn't sufficiently manage the access to content administrative paths allowing an attacker to see and take actions on content (nodes) they should be allowed to.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist:https://packages.drupal.org/8/drupal/domain_group

Introduced in: 0Fixed in: 1.4.0

Upgrade drupal/domain_group to 1.4.0 or newer (ecosystem packagist:https://packages.drupal.org/8).

References

https://www.drupal.org/sa-contrib-2021-037[WEB]