Cross-Site Request Forgery in Drupal core
Moderate severity
GitHub Reviewed
Published
Feb 12, 2022
to the GitHub Advisory Database
•
Updated Apr 6, 2023
Package
Affected versions
>= 9.1.0, < 9.1.13
>= 9.2.0, < 9.2.6
>= 8.0.0, < 8.9.19
Patched versions
9.1.13
9.2.6
8.9.19
Description
Published by the National Vulnerability Database
Feb 11, 2022
Published to the GitHub Advisory Database
Feb 12, 2022
Reviewed
Feb 23, 2022
Last updated
Apr 6, 2023
Credits
-
tdunlap607 Analyst
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
References