CVE-2019-6342: Critical - Access bypass
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.7.5 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.7.5 - Configuration
Disable the experimental Workspaces module to mitigate the access bypass vulnerability.
Drupal 8 core Workspaces module enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2019-6342?
The severity of CVE-2019-6342 is critical.
How does CVE-2019-6342 affect Drupal Core?
CVE-2019-6342 affects Drupal Core versions 8.7.3 to 8.7.5.
What is the vulnerability type of CVE-2019-6342?
CVE-2019-6342 is an Access Bypass vulnerability.
How can I fix CVE-2019-6342 in Drupal Core?
To fix CVE-2019-6342 in Drupal Core, you should upgrade to version 8.7.6.
Where can I find more information about CVE-2019-6342?
You can find more information about CVE-2019-6342 on the Drupal website at https://www.drupal.org/sa-core-2019-008.