Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.Project:
Date:
2023-March-15
Vulnerability:
Information disclosure
Affected versions:
<1.5.0
Description:
The Media Responsive Thumbnail module allows media reference fields to be rendered as a responsive image.
This module does not properly check entity access prior to rendering media. This may result in users seeing thumbnails of media items they do not have access to.
This release was coordinated with SA-CORE-2023-002.
Solution:
Install the latest version:
- If you use the Media Responsive Thumbnail module, upgrade to Media Responsive Thumbnail 8.x-1.5
Reported By:
Fixed By:
- Ivan Vidusenko
- Benji Fisher of the Drupal Security Team
Coordinated By:
- Benji Fisher of the Drupal Security Team
- Lee Rowlands of the Drupal Security Team
- Joseph Zhao Provisional Member of the Drupal Security Team
- Greg Knaddison of the Drupal Security Team
- Dave Long of the Drupal Security Team
