DRUPAL-CONTRIB-2022-044
Entity Browser Block provides a Block Plugin for every Entity Browser on your site.
The module didn't sufficiently check entity view access in the block form.
This vulnerability is mitigated by the fact that an attacker must be able to place a block - either through the core "Block Layout" page or via a module like Layout Builder.
What each source reports
OSV No score
Entity Browser Block provides a Block Plugin for every Entity Browser on your site.
The module didn't sufficiently check entity view access in the block form.
This vulnerability is mitigated by the fact that an attacker must be able to place a block - either through the core "Block Layout" page or via a module like Layout Builder.
- Record
DRUPAL-CONTRIB-2022-044- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/entity_browser_blockPackagist:https://packages.drupal.org/8 |
before 1.2.0 | 1.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2022-044 is a vulnerability with no CVSS score yet in drupal/entity_browser_block, published May 25, 2022. No source lists public exploit code. Fixed in drupal/entity_browser_block 1.2.0.