Date:
Wednesday, Mar 8th, 2017
Advisory ID:
BACKDROP-SA-CONTRIB-2017-002
Security risk:
Moderately Critical
Vulnerability:
Information Disclosure
Versions affected:
Description:
This module enables you to add a variety of meta tags to a site for helping with a site's search engine results and to customize how content is shared on social networks.
The module doesn't sufficiently protect against data being cached that might contain information related to a specific user.
This vulnerability is mitigated by the fact that a site must have a page with sensitive data in the page title that varies per logged in user.
Solution:
Install the latest version:
- If you use the Metatag module for Backdrop 1.x, upgrade to Metatag 7.x-1.21.0 or later.
Reported By:
Fixed By:
- Jennifer Lea Lampton, the Backdrop module maintainer.
- Damien McKenna, the Drupal module maintainer.
- Klaus Purer, of the Drupal Security Team.
Coordinated By:
- Jennifer Lea Lampton, the Backdrop module maintainer.
- Damien McKenna, the Drupal module maintainer.
- Klaus Purer, of the Drupal Security Team.
- Geoff St Pierre, of the Backdrop CMS Security Team.