Access Control Flaw in Quick Edit Module for Drupal by Drupal
CVE-2022-25270

6.5MEDIUM

Key Information:

Vendor
Drupal
Status
Core
Vendor
CVE Published:
17 February 2022

Summary

The Quick Edit module in Drupal fails to adequately verify entity access, allowing users with the 'access in-place editing' permission to potentially view content they should not be authorized to access. This issue primarily affects sites that have the Quick Edit module enabled, which is included with the Standard profile.

Affected Version(s)

Core 9.3.x < 9.3.6

Core 9.2.x < 9.2.13

References

https://www.drupal.org/sa-core-2022-004
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.