3.5 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
0.967 High
EPSS
Percentile
99.7%
Node Field module allows you to add custom extra fields to single Drupal nodes.
The module doesn’t sufficiently sanitize user input for some of the module’s internal fields. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create nodes.
Drupal core is not affected. If you do not use the contributed Node Field module,
there is nothing you need to do.
Install the latest version:
Also see the Node Field project page.
twitter.com/drupalsecurity
www.drupal.org/contact
www.drupal.org/node/2373157
www.drupal.org/project/node_field
www.drupal.org/security-team
www.drupal.org/security-team/risk-levels
www.drupal.org/security/secure-configuration
www.drupal.org/user/124982
www.drupal.org/user/1992676
www.drupal.org/user/2997345
www.drupal.org/user/36762
www.drupal.org/user/88338
www.drupal.org/writing-secure-code