All Token Content Access versions prior to 1.x-1.2.2
The Token Content Access module enables site administrators to provide access to content using access tokens.
The module does not sufficiently protect access token comparison in some cases. This could allow a persistent attacker to use a timing attack to guess a valid access token and bypass access restrictions for content protected by this module.
This vulnerability is mitigated by the fact that an attacker must know or discover both the URL and the parameter key for content protected by Token Content Access, and exploiting the issue requires measuring timing differences in token comparison responses.
Upgrade your site to the most recent version of Token Content Access Download available on the Token Content Access release page. See the update instructions, if needed.
- Bram Driesen (bramdriesen) of the Drupal Security Team
- cilefen (cilefen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Jen Lampton (jenlampton) of the Backdrop CMS Security Team
- Herb v/d Dool (herbdool) of the Backdrop CMS Security Team