Drupal Core
At a glance
- Source
- NVD
- EPSS
- EPSS 0.80 % · percentile 57 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- drupal
- NVD status
- Modified
Description
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- DRUPAL-CORE-2021-009 — The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.
- GHSA-qfhg-m6r8-xxpj — Incorrect Authorization in Drupal core
European references
- ENISA EUVD · EUVD-2022-1150
- GCVE · GCVE-0-2020-13676
CERT-FR advisories
- CERTFR-2021-AVI-712 — Multiples vulnérabilités dans Drupal Core · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.9.0 < 8.9.19cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 9.1.0 < 9.1.13cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 9.2.0 < 9.2.6
Affected products
| Product | Versions |
|---|---|
| Drupal · Core | affected 9.2 < 9.2.6 ; affected 9.1 < 9.1.13 ; affected 8.9 < 8.9.19 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |