GSD-2022-25270
Vulnerability from gsd - Updated: 2023-12-13 01:19Details
The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2022-25270",
"description": "The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the \"access in-place editing\" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.",
"id": "GSD-2022-25270"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2022-25270"
],
"details": "The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the \"access in-place editing\" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.",
"id": "GSD-2022-25270",
"modified": "2023-12-13T01:19:26.584819Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security@drupal.org",
"ID": "CVE-2022-25270",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Core",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "9.3.x",
"version_value": "9.3.6"
},
{
"version_affected": "\u003c",
"version_name": "9.2.x",
"version_value": "9.2.13"
}
]
}
}
]
},
"vendor_name": "Drupal"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the \"access in-place editing\" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": " Information disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.drupal.org/sa-core-2022-004",
"refsource": "CONFIRM",
"url": "https://www.drupal.org/sa-core-2022-004"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003e=9.2.0,\u003c9.2.13||\u003e=9.3.0,\u003c9.3.6",
"affected_versions": "All versions starting from 9.2.0 before 9.2.13, all versions starting from 9.3.0 before 9.3.6",
"cvss_v2": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-863",
"CWE-937"
],
"date": "2022-02-25",
"description": "The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the \"access in-place editing\" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.",
"fixed_versions": [
"9.2.13",
"9.3.6"
],
"identifier": "CVE-2022-25270",
"identifiers": [
"CVE-2022-25270"
],
"not_impacted": "All versions before 9.2.0, all versions starting from 9.2.13 before 9.3.0, all versions starting from 9.3.6",
"package_slug": "packagist/drupal/core-recommended",
"pubdate": "2022-02-17",
"solution": "Upgrade to versions 9.2.13, 9.3.6 or above.",
"title": "Incorrect Authorization",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2022-25270",
"https://www.drupal.org/sa-core-2022-004"
],
"uuid": "bf29bb89-de0a-4a3b-b1ce-7a47936ee741"
},
{
"affected_range": "\u003e=9.2.0,\u003c9.2.13||\u003e=9.3.0,\u003c9.3.6",
"affected_versions": "All versions starting from 9.2.0 before 9.2.13, all versions starting from 9.3.0 before 9.3.6",
"cvss_v2": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-863",
"CWE-937"
],
"date": "2022-02-25",
"description": "The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the \"access in-place editing\" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.",
"fixed_versions": [
"9.2.13",
"9.3.6"
],
"identifier": "CVE-2022-25270",
"identifiers": [
"CVE-2022-25270"
],
"not_impacted": "All versions before 9.2.0, all versions starting from 9.2.13 before 9.3.0, all versions starting from 9.3.6",
"package_slug": "packagist/drupal/core",
"pubdate": "2022-02-17",
"solution": "Upgrade to versions 9.2.13, 9.3.6 or above.",
"title": "Incorrect Authorization",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2022-25270",
"https://www.drupal.org/sa-core-2022-004"
],
"uuid": "df1b42e2-3d12-47a5-9b94-803f80d89c66"
},
{
"affected_range": "\u003e=9.2.0,\u003c9.2.13||\u003e=9.3.0,\u003c9.3.6",
"affected_versions": "All versions starting from 9.2.0 before 9.2.13, all versions starting from 9.3.0 before 9.3.6",
"cvss_v2": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-863",
"CWE-937"
],
"date": "2022-02-25",
"description": "The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the \"access in-place editing\" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.",
"fixed_versions": [],
"identifier": "CVE-2022-25270",
"identifiers": [
"CVE-2022-25270"
],
"not_impacted": "",
"package_slug": "packagist/drupal/drupal",
"pubdate": "2022-02-17",
"solution": "Unfortunately, there is no solution available yet.",
"title": "Incorrect Authorization",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2022-25270",
"https://www.drupal.org/sa-core-2022-004"
],
"uuid": "9bfb4999-2c8c-4f9d-827b-072a5d1a7e38"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "9.2.13",
"versionStartIncluding": "9.2.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "9.3.6",
"versionStartIncluding": "9.3.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security@drupal.org",
"ID": "CVE-2022-25270"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the \"access in-place editing\" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.drupal.org/sa-core-2022-004",
"refsource": "CONFIRM",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.drupal.org/sa-core-2022-004"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
},
"lastModifiedDate": "2022-02-25T14:34Z",
"publishedDate": "2022-02-17T00:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…