—

DRUPAL-CONTRIB-2024-008

Details

The Migrate Tools module provides tools for running and managing Drupal migrations.

The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an attacker to trick an authenticated administrator into initiating a migration.

This vulnerability is mitigated by the fact that an attacker must know the name of the migration.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist:https://packages.drupal.org/8/drupal/migrate_tools

Introduced in: 0Fixed in: 6.0.3

Upgrade drupal/migrate_tools to 6.0.3 or newer (ecosystem packagist:https://packages.drupal.org/8).

References

https://www.drupal.org/sa-contrib-2024-008[WEB]