UBUNTU-CVE-2022-25275

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However,...

PT-2023-12782 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal version 9.3 Description: The issue arises from the incomplete integration of the generic entity access API for entity revisions with existing permissions in Drupal 9.3. This results in possible access bypass for users who have access t...

Drupal 安全漏洞

Drupal is an open source content management system developed in PHP by the Drupal community. A security vulnerability exists in Drupal version 9.3, which stems from the fact that the Common Entity Access API is not fully integrated with existing permissions, resulting in the possibility of certai...

DRUPAL-CORE-2023-005

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your...

PT-2022-17184 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal versions prior to the fixed version Description: The Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access ...