"Ricochet has proven to be a partner that we can depend on to create and maintain a successful drupal-based CMS system. Their deep experience in drupal has allowed them to identify existing plugins and to quickly implement custom logic when required to efficiently implement our international content management workflow and site. Ricochet has shown their commitment to our success again and again, working collaboratively across our team to make it happen, and putting in the extra effort when needed to meet our business goals."
—David Saffren, Blurb.com

Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030

Wed, 2024-08-21 09:23 — Anonymous (not verified)

Project: Responsive and off-canvas menuDate: 2024-August-21Security risk: Moderately critical 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <4.4.4Description: This module integrates the mmenu library with Drupal's menu system with the aim of having an off-canvas mobile menu and a horizontal menu at wider widths.
The module doesn't respect custom node access restrictions implemented through hook_ENTITY_TYPE_access hooks meaning the titles of restricted nodes can appear in the menu.
Only sites with modules that implement hook_ENTITY_TYPE_access to restrict access to nodes are effected.Solution: Install the latest version:

If you use the 4.x branch of the responsive_menu module upgrade to 4.4.4

Reported By:

collinhaines

Fixed By:

Stephen Cox

Coordinated By:

Greg Knaddison of the Drupal Security Team
Juraj Nemec of the Drupal Security Team
Drew Webber of the Drupal Security Team

Path to article https://www.drupal.org/sa-contrib-2024-030

Search form

Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030