The Shield module enables you to protect a site behind an HTTP basic authentication prompt, so that an unfinished or non-public site cannot be viewed, crawled o...

An anonymous visitor can repeatedly try HTTP basic authentication credentials because Shield does not sufficiently limit authentication attempts. If the configured credentials are guessable, an attacker could guess them and get past Shield's barrier. Shield is intended as an extra barrier, not as the site's user access control system.

Look for drupal/shield and its version in composer.lock. The advisory lists 1.9.0 as fixed but gives no affected version range. Check whether Shield protects your site with HTTP basic authentication and whether its configured credentials are guessable.

Use a long, randomly generated Shield password, which the advisory says is not practically brute forceable. Treat Shield as a supplementary barrier rather than the site's user access control system.

The Shield module enables you to protect a site behind an HTTP basic authentication prompt, so that an unfinished or non-public site cannot be viewed, crawled or indexed by anonymous visitors.

The module doesn't sufficiently limit the number of authentication attempts it will evaluate under the scenario where an anonymous visitor repeatedly submits basic authentication credentials.

This vulnerability is mitigated by the fact that the configured Shield credentials must be guessable — a long, randomly generated password is not practically brute forceable — and by the fact that Shield is intended as a supplementary barrier in front of a site rather than the site's user access control systems.