DRUPAL-CONTRIB-2019-013
This module provides a field on user profiles which allows users to get a notification when their account logs in to the site. The notification e-mail includes a link which will terminate all sessions for that user. This is useful in the case of unauthorised access to the account.
The module doesn't employ sufficient randomness in the generation of URLs, which represents an Access Bypass vulnerability.
What each source reports
OSV No score
This module provides a field on user profiles which allows users to get a notification when their account logs in to the site. The notification e-mail includes a link which will terminate all sessions for that user. This is useful in the case of unauthorised access to the account.
The module doesn't employ sufficient randomness in the generation of URLs, which represents an Access Bypass vulnerability.
- Record
DRUPAL-CONTRIB-2019-013- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/login_alertPackagist:https://packages.drupal.org/8 |
before 1.3.0 | 1.3.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2019-013 is a vulnerability with no CVSS score yet in drupal/login_alert, published February 6, 2019. No source lists public exploit code. Fixed in drupal/login_alert 1.3.0.