Drupal Acquia DAM Missing Authorization Vulnerability Allowing Forceful Browsing

A missing authorization vulnerability has been identified in Drupal Acquia DAM versions prior to 1.1.5. This vulnerability allows forceful browsing by creating an access bypass to a list of DAM assets currently synced to the website. The issue arises because the module does not adequately validate authorization for these assets, potentially leading to unauthorized access.

Impact

Exploitation of this vulnerability bypasses access controls, allowing unauthorized users to view DAM assets they should not have access to.

Remediation

Users can upgrade to Acquia DAM version 1.1.5 or later, which automatically adjusts view permissions to align with the 'access media overview' permission. For sites that cannot update, the issue can be mitigated by manually restricting access on three views: Acquia DAM Asset Library, Acquia DAM links, and DAM Content Overview.