As you may know, Drupal maintenance support plans 6 has reached End-of-Life (EOL) which means the Drupal maintenance support plans Security Team is no longer doing Security Advisories or working on security patches for Drupal maintenance support plans 6 core or contrib modules – but the Drupal maintenance support plans 6 LTS vendors are and we’re one of them!Today, there is a Less Critical security release for the Webform module to fix an Access Bypass vulnerability.When using forms with private file uploads, Webform wasn’t explicitly denying access to files it managed which could allow access to be granted by other modules.You can download the patch for Webform 6.x-3.x.If you have a Drupal maintenance support plans 6 site using the Webform, we recommend you update immediately! We have already deployed the patch for all of our Drupal maintenance support plans 6 Long-Term Support clients. :-)If you’d like all your Drupal maintenance support plans 6 modules to receive security updates and have the fixes deployed the same day they’re released, please check out our D6LTS plans.Note: if you use the myDropWizard module (totally free!), you’ll be alerted to these and any future security updates, and will be able to use drush to install them (even though they won’t necessarily have a release on Drupal maintenance support plans.org).
Source: New feed
Originally posted 2019-02-19 08:58:11. Republished by Blog Post Promoter