DRUPAL-CONTRIB-2023-031
The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into performing unwanted actions.
This vulnerability is mitigated by the fact that the set of unwanted actions is limited to specific configurations.
What each source reports
OSV No score
The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into performing unwanted actions.
This vulnerability is mitigated by the fact that the set of unwanted actions is limited to specific configurations.
- Record
DRUPAL-CONTRIB-2023-031- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/symfony_mailerPackagist:https://packages.drupal.org/8 |
before 1.2.2, 1.3.0-beta1 up to 1.3.0-rc3 | 1.2.21.3.0-rc3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2023-031 is a vulnerability with no CVSS score yet in drupal/symfony_mailer, published July 26, 2023. No source lists public exploit code. Fixed in drupal/symfony_mailer 1.2.2.