DRUPAL-CONTRIB-2022-058 This module enables themers to get partial data from field render arrays.
Attackers can bypass access restrictions to read unpublished content or protected data via specific field filters in this Drupal module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2022-058?
DRUPAL-CONTRIB-2022-058 is a missing authorization vulnerability in drupal/twig_field_value, published on 12 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
This module enables themers to get partial data from field render arrays. It gives them more control over the output without drilling deep into the render array or using preprocess functions.
The module doesn't sufficiently apply access restrictions when using the filters field_label, field_value, field_raw and field_target_entity.
This vulnerability is mitigated by the fact that these filters must be used in combination with either unpublished content or access control modules.
Which versions are affected by DRUPAL-CONTRIB-2022-058?
Linux distribution packages (1)
drupal/twig_field_value Packagist:https://packages.drupal.org/8 | All versions | 2.0.1 |
How do I fix DRUPAL-CONTRIB-2022-058?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is DRUPAL-CONTRIB-2022-058 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2022-058 in the wild and no public exploit code.