DRUPAL-CONTRIB-2019-067
This module allows you to attach tabular data to an entity.
There is insufficient access checking for users with the ability to "Export Tablefield Data as CSV". They can export data from unpublished nodes or otherwise inaccessible entities.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Export Tablefield Data as CSV".
What each source reports
OSV No score
This module allows you to attach tabular data to an entity.
There is insufficient access checking for users with the ability to "Export Tablefield Data as CSV". They can export data from unpublished nodes or otherwise inaccessible entities.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Export Tablefield Data as CSV".
- Record
DRUPAL-CONTRIB-2019-067- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/tablefieldPackagist:https://packages.drupal.org/8 |
before 2.1.0 | 2.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2019-067 is a vulnerability with no CVSS score yet in drupal/tablefield, published September 18, 2019. No source lists public exploit code. Fixed in drupal/tablefield 2.1.0.