| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/core | ≥ 8.0, < 8.1.10 | 8.1.10 |
| drupal/drupal | ≥ 8.0, < 8.1.10 | 8.1.10 |
| drupal | = 8.0.0= 8.0.1= 8.0.2= 8.0.3= 8.0.4= 8.0.5= 8.0.6= 8.1.0= 8.1.1= 8.1.2= 8.1.3= 8.1.4= 8.1.5= 8.1.6= 8.1.7= 8.1.8= 8.1.9 |
The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free