Description
The Outline Designer module provides usability improvements to Drupal core's Book module, including an AJAX-driven interface for restructuring book content outlines.
The `outline_designer_book_process_change_type()` function, which handles content type changes via the Outline Designer AJAX callback, only checked whether the user had `update` access on the current node. It did not verify that the target type was present in `book_allowed_types` nor that the user held `create` access on the target content type.
This vulnerability is mitigated by the fact that exploitation requires an authenticated user with at least "edit" permission on an existing book node, and the Outline Designer module must be installed and in active use.
Solution
Install the latest version.
If you use the Outline Designer module for Drupal 7, upgrade to outline_designer 7.x-2.4:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES