—
DRUPAL-CONTRIB-2024-029
Details
The Opigno Learning Path module enables you to manage group content.
Administrative forms allow uploading malicious files which may contain arbitrary code (RCE) or cross site scriptiong (XSS). These forms were not adequately controlled with permissions that communicate the severity of the permission.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Manage group content in any group".
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/opigno_learning_path
Introduced in:
0Fixed in: 3.1.2Upgrade drupal/opigno_learning_path to 3.1.2 or newer (ecosystem packagist:https://packages.drupal.org/8).