Is it possible for a module that is installed but not enabled to pose a security risk?
Corollary question: Is it a recommended practice to update disabled modules when security updates become available?
Add a comment
|
1 Answer
I say yes since the vulnerable code is still sitting right there in the web directory which can (will) be scanned by potential attackers. Monitoring disabled modules is certainly part of our update routine.
I didn't find a whole lot of discussion on this in regards to Drupal in particular, likely because it isn't really a Drupal-related issue (see note below). Greg Knaddison (@greggles on Drupal.org) noted on a thread a few years back that:
Sometimes the vulnerabilities exist regardless of whether or not the module is enabled, so I think it's better to warn on all modules.
Source: Issue #942960: Don't warn about security updates for disabled modules
As always, best to err on the side of caution.
Note: I think this is more a server admin related question, but I hesitate to flag it as not relevant since IMHO people who aren't server admins shouldn't really be expected to know that.
