{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c2.6.0 || \u003e=3.0.0 \u003c3.4.0"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/views_bulk_operations"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c2.6.0"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=3.0.0 \u003c3.4.0"
          },
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/user/2650563"
      ],
      "name": "Adam Shepherd"
    }
  ],
  "details": "Views Bulk Operations provides enhancements to running bulk actions on views.\n\nThe module contains an access bypass vulnerability that might allow users to execute views actions that they should not have access to.\n\nThis vulnerability is mitigated by the fact that it only occurs in the case of customised action access (by means of hook\\_action\\_info\\_alter).",
  "id": "DRUPAL-CONTRIB-2020-003",
  "modified": "2023-08-11T17:58:52.000Z",
  "published": "2020-02-05T16:59:21.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2020-003"
    }
  ],
  "schema_version": "1.7.0"
}