DRUPAL-CONTRIB-2021-043 This module enables aklump/loft\_data\_grids to be used as a Drupal module.
The module relies on an abandoned library with known vulnerabilities, but is not directly exploitable unless custom code uses its API to read spreadsheets.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- Available
What is DRUPAL-CONTRIB-2021-043?
DRUPAL-CONTRIB-2021-043 is a vulnerability in drupal/loft_data_grids, published on 13 Oct 2021.
Official description
This module enables aklump/loft_data_grids to be used as a Drupal module.
Excel support was provided by <https://packagist.org/packages/phpoffice/phpexcel>, which is abandoned and there are known security vulnerabilities: [CVE-2018-19277]: PHPOffice/PhpSpreadsheet#771. Excel support has since been replaced with the newer <https://github.com/PHPOffice/PhpSpreadsheet> library.
This module provides an API and This vulnerability is not exploitable in the module itself. This vulnerability only exists if custom code or another module uses the API of this module to read a spreadsheet.
Which versions are affected by DRUPAL-CONTRIB-2021-043?
Linux distribution packages (1)
drupal/loft_data_grids Packagist:https://packages.drupal.org/8 | All versions | 1.4.0 |
How do I fix DRUPAL-CONTRIB-2021-043?
Upgrade to a fixed version.
Is DRUPAL-CONTRIB-2021-043 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2021-043 in the wild and no public exploit code.