DRUPAL-CONTRIB-2022-044 Entity Browser Block provides a Block Plugin for every Entity Browser on your site.
An attacker with block placement permissions can bypass entity view access checks to read unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2022-044?
DRUPAL-CONTRIB-2022-044 is a missing authorization vulnerability in drupal/entity_browser_block, published on 25 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Entity Browser Block provides a Block Plugin for every Entity Browser on your site.
The module didn't sufficiently check entity view access in the block form.
This vulnerability is mitigated by the fact that an attacker must be able to place a block - either through the core "Block Layout" page or via a module like Layout Builder.
Which versions are affected by DRUPAL-CONTRIB-2022-044?
Linux distribution packages (1)
drupal/entity_browser_block Packagist:https://packages.drupal.org/8 | All versions | 1.2.0 |
How do I fix DRUPAL-CONTRIB-2022-044?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2022-044 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2022-044 in the wild and no public exploit code.