Overview

Drupal is vulnerable to a critical vulnerability. A remote attacker can exploit the vulnerability to bypass access control.

Description

Basic HTTT Authentication module in Drupal is vulnerable to critical vulnerability. The module provides a possibility to restrict access to specific paths using basic HTTP authentication, in addition to standard Drupal access checks. The flaw exists when the module removes existing access checks from some paths, resulting in an access bypass vulnerability.

Impact

Successful exploitation of this vulnerability may allow the attacker to gain access to the vulnerable system.

Solution

Drupal has released security patch for this vulnerability. Users and administrators are encouraged to apply necessary updates.

References

• 1. https://www.drupal.org/sa-contrib-2024-057