DRUPAL-CONTRIB-2023-040
The Data Field module provides a way of building field types that are made up of other fields, a simpler alternative to e.g. the Paragraphs system.
Access to these forms isn't properly validated, allowing a user with the "access content" permission to view and edit fields on entities.
What each source reports
OSV No score
The Data Field module provides a way of building field types that are made up of other fields, a simpler alternative to e.g. the Paragraphs system.
Access to these forms isn't properly validated, allowing a user with the "access content" permission to view and edit fields on entities.
- Record
DRUPAL-CONTRIB-2023-040- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/datafieldPackagist:https://packages.drupal.org/8 |
before 1.0.16 | 1.0.16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2023-040 is a vulnerability with no CVSS score yet in drupal/datafield, published August 23, 2023. No source lists public exploit code. Fixed in drupal/datafield 1.0.16.