Project: 
Mailer Plus (DSM+)
Project machine name: 
symfony_mailer
Date: 
2023-July-26
Security risk: 
Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Cross site request forgery
Affected versions: 
<1.2.2 || >=1.3.0 <1.3.0-rc3
Description: 

The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into performing unwanted actions.

This vulnerability is mitigated by the fact that the set of unwanted actions is limited to specific configurations.

Solution: 

Originally the solution was listed as just updating the module, however, a cache rebuild will be necessary for the solution to take effect.

  • If you use Drupal Symfony Mailer module v1.2.x, upgrade to v1.2.2 and rebuild Drupal's cache.
  • If you use Drupal Symfony Mailer module v1.3.x, upgrade to v1.3.0-rc3 and rebuild Drupal's cache.
Reported By: 
Fixed By: