DRUPAL-CONTRIB-2023-049

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/paragraphs_admin/DRUPAL-CONTRIB-2023-049.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2023-049

Published

2023-11-01T16:56:37Z

Modified

2025-12-10T23:30:01.211696Z

Summary

[none]

Details

This module enables you to view all paragraph entities in an admin view.
The module contains an access bypass that allows non admin users to access the view.
The vulnerability can be mitigated by editing the view to change the permission required to access the page.

References

https://www.drupal.org/sa-contrib-2023-049

Credits

- Jen M
- - https://www.drupal.org/user/3085703

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/paragraphs_admin

Package

Name: drupal/paragraphs_admin
Purl: pkg:composer/drupal/paragraphs_admin

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

1.5.0

Database specific

{
    "constraint": "<1.5.0"
}

Database specific

affected_versions

"<1.5.0"

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/paragraphs_admin/DRUPAL-CONTRIB-2023-049.json"