Apigee Edge - Moderately critical - Access bypass - SA-CONTRIB-2023-005

Project: Apigee EdgeDate: 2023-February-01Security risk: Moderately critical 13∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassDescription: The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal.
Previous module versions did not support entity query level access checking which could have lead to information disclosure or access bypass in various places. Solution: Install the latest version:

• If you use the Apigee Edge module version 2.0.x for Drupal 9.x, upgrade to Apigee Edge 2.0.8
• If you use the Apigee Edge module version 8.x-1.x for Drupal 9.x, upgrade to Apigee Edge 8.x-1.27

Reported By: 

• Dezső Biczó

Fixed By: 

• Dezső Biczó
• Shishir Suvarna

Coordinated By: 

• Greg Knaddison of the Drupal Security Team