DRUPAL-CONTRIB-2022-059 This module enables you to build searches using a wide range of features, data sources and backends.
A Drupal search module may disclose information in specific setups due to incorrect active search detection, though exploitation is difficult.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2022-059?
DRUPAL-CONTRIB-2022-059 is a vulnerability in drupal/search_api, published on 19 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This module enables you to build searches using a wide range of features, data sources and backends.
The module doesn't in all cases correctly detect whether a given search is active on the current page, leading to potential information disclosure for some setups.
This vulnerability is mitigated by the fact that only very specific setups will have this problem and there is no way for an attacker to trigger it.
Which versions are affected by DRUPAL-CONTRIB-2022-059?
Linux distribution packages (1)
drupal/search_api Packagist:https://packages.drupal.org/8 | All versions | 1.27.0 |
How do I fix DRUPAL-CONTRIB-2022-059?
Upgrade to a fixed version.
Is DRUPAL-CONTRIB-2022-059 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2022-059 in the wild and no public exploit code.