Open-source package vulnerability · Composer (PHP)
GHSA-jjx7-8462-w4m4: Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
critical
The Contextual Links module doesn't sufficiently validate the requested contextual links. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access contextual links".
Published May 15, 2024
Affected packages
drupal/drupal
- Ecosystem
- Composer (PHP)
- Affected
- >= 8.0.0, < 8.5.8
- Fixed in
- 8.5.8
- Check
composer show drupal/drupal
drupal/drupal
- Ecosystem
- Composer (PHP)
- Affected
- >= 8.6.0, < 8.6.2
- Fixed in
- 8.6.2
- Check
composer show drupal/drupal
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The Contextual Links module doesn't sufficiently validate the requested contextual links. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access contextual links".
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology