DRUPAL-CONTRIB-2021-030
This module enables you to create an individual hash for each user. These hashes can be used for authentication instead of the user's password, e.g. for views exporters.
The module doesn't sufficiently invalidate page output when the page_cache module is used.
This vulnerability is mitigated by the fact that an attacker must have a user hash that grants access to specific content and the attack must be timed to the reset of the page cache.
What each source reports
OSVNo score
This module enables you to create an individual hash for each user. These hashes can be used for authentication instead of the user's password, e.g. for views exporters.
The module doesn't sufficiently invalidate page output when the page_cache module is used.
This vulnerability is mitigated by the fact that an attacker must have a user hash that grants access to specific content and the attack must be timed to the reset of the page cache.
- Record
DRUPAL-CONTRIB-2021-030- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/user_hashPackagist:https://packages.drupal.org/8 | before 2.0.1 | 2.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2021-030 is a vulnerability with no CVSS score yet in drupal/user_hash, published September 22, 2021. No source lists public exploit code. Fixed in drupal/user_hash 2.0.1.