Drupal Patches Vulnerabilities

Updates released for Drupal 8.9, 9.1 and 9.2 patch five vulnerabilities that can be exploited for CSRF and access bypass issues.

Three of the flaws are related to access bypass. They involve the JSON:API, REST/File, and QuickEdit modules, and they can allow an attacker to access data or upload arbitrary files, but certain conditions need to be met for an attack to work.

According to Drupal developers, their exploitation could lead to HTML code injection into a page accessed by a trusted user and possible data integrity issues, respectively.

All of the vulnerabilities have been assigned a moderately critical severity rating. It’s worth noting that Drupal classifies vulnerabilities based on the NIST Common Misuse Scoring System and moderately critical is roughly the equivalent of medium severity in the CVSS method.

The vulnerabilities have been patched with the release of versions 9.2.6, 9.1.13 and 8.9.19. Drupal 7 is not affected, and Drupal 8 prior to 8.9.x and Drupal 9 prior to 9.1.x have reached end of life and will not be receiving fixes.This is the sixth round of security updates released this year for Drupal.