DRUPAL-CONTRIB-2023-010

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/media_responsive_thumbnail/DRUPAL-CONTRIB-2023-010.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2023-010
Published
2023-03-15T17:22:57Z
Modified
2026-09-10T03:46:00Z
Summary
[none]
Details

The Media Responsive Thumbnail module allows media reference fields to be rendered as a responsive image.

This module does not properly check entity access prior to rendering media. This may result in users seeing thumbnails of media items they do not have access to.

This release was coordinated with SA-CORE-2023-002.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/media_responsive_thumbnail

Package

Name
drupal/media_responsive_thumbnail
Purl
pkg:composer/drupal/media_responsive_thumbnail?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.5.0
Database specific
Show details 
{
    "constraint": "<1.5.0"
}

Database specific

affected_versions 
"<1.5.0"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/media_responsive_thumbnail/DRUPAL-CONTRIB-2023-010.json"