Issue 182: Drupal patches API vulnerability, Google Cloud on API security challenges, guide to OAuth2
Brief
This week, we have details of an API vulnerability in the Drupal platform, allowing an attacker to bypass access controls. We also feature views from Google Cloud on challenges to API security, a comprehensive guide to OAuth2, and finally a write up on how GitHub deviates from the implementation guidelines for OAuth2.
Vulnerability: Drupal patches an API vulnerability allowing access bypass
This week, Drupal has announced a security update to patch a vulnerability in the API of version 9.3 of their platform, a popular open-source content management system.
Drupal exposes an API to facilitate integration and plugin framework. Unfortunately, Drupal has disclosed that an API did not adequately authorize access to the backend. Potentially, this could have allowed attackers to access content outside of the core Drupal access controls.