• Advisory ID: DRUPAL-SA-CONTRIB-2017-042
• Project: Media (third-party module)
• Date: 12-Apr-2017

Description

The Media module provides an extensible framework for managing files and multimedia assets, regardless of whether they are hosted on your own site or a 3rd party site – it is commonly referred to as a ‘file browser to the internet’.

Versions affected

• Only the 1.x branch is affected. Version 2.0 does not have this vulnerability.

Drupal core is not affected. If you do not use the contributed Media module, there is nothing you need to do.

Solution

If you use the Media 1.x branch you should upgrade to version 2.0 or later.

See the Media 2.0 release notes for more information on how to upgrade (it’s more complex than most contrib upgrades – for example, it involves other contrib modules moving from media_entity to file_entity)!

Also see the Media project page.

Reported by

• Fabricio Bedoya
• Almc
• Lee Rowlands
• Andrew Berry
• Matt Glaman
• Pieter Frenssen
• Andy Tawse
• Chi
• Damian Robinson

Fixed by

Not applicable

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity