An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.
Scores
Version
Score
Vecteur
Évalué par
CVSS 3.1
CRITICAL 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD · nvd@nist.gov (Primary)
CVSS 2.0
MEDIUM 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
NVD · nvd@nist.gov (Primary)
Avis
DRUPAL-CORE-2019-008 — In Drupal 8.7.4, when the [experimental](https://www.drupal.org/core/experimental#beta) Workspaces module is enabled, an access bypass condition is created.
