Security update

See Entity Browser - Moderately critical - Information Disclosure - SA-CONTRIB-2023-002

Contributors (1)

Anybody

Changelog

Issues: 1 issues resolved.

Changes since 8.x-2.8:

Media Library Form API Element - Moderately critical - Information Disclosure - SA-CONTRIB-2023-004

The module module did not properly check entity access in some circumstances. This may have resulted in users with access to edit content seeing metadata about media items they are not authorized to access.

The vulnerability is mitigated by the fact that the inaccessible media will only be visible to users who can already edit content that includes a media reference field.

Private Taxonomy Terms - Moderately critical - Access bypass - SA-CONTRIB-2023-001

List of changes since 7.x-1.1

See also File (Field) Paths - Not critical - Access bypass - SA-CONTRIB-2022-065

List of included changes since 8.x-1.0-beta5

Partially addresses File (Field) Paths - Not critical - Access bypass - SA-CONTRIB-2022-065

See H5P - Create and Share Rich Content and Applications - Critical - Remote Code Execution - SA-CONTRIB-2022-064.

PHP8 compatibility.