DRUPAL-CONTRIB-2023-010
The Media Responsive Thumbnail module allows media reference fields to be rendered as a responsive image.
This module does not properly check entity access prior to rendering media. This may result in users seeing thumbnails of media items they do not have access to.
This release was coordinated with SA-CORE-2023-002.
What each source reports
OSV No score
The Media Responsive Thumbnail module allows media reference fields to be rendered as a responsive image.
This module does not properly check entity access prior to rendering media. This may result in users seeing thumbnails of media items they do not have access to.
This release was coordinated with SA-CORE-2023-002.
- Record
DRUPAL-CONTRIB-2023-010- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/media_responsive_thumbnailPackagist:https://packages.drupal.org/8 |
before 1.5.0 | 1.5.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2023-010 is a vulnerability with no CVSS score yet in drupal/media_responsive_thumbnail, published March 15, 2023. No source lists public exploit code. Fixed in drupal/media_responsive_thumbnail 1.5.0.