| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/facets | ≥ 3.0.0, < 3.0.1< 2.0.10 | 3.0.12.0.10 |
| facets | ≥ 3.0.0, < 3.0.1< 2.0.10 | 3.0.12.0.10 |
This module enables you to to easily create and manage faceted search interfaces.
The module doesn't sufficiently check access to entities when they are displayed as facets.
This vulnerability is mitigated by the fact that only sites that show facets with entity labels (like taxonomy terms) are affected, and only if some of those entities are unpublished or have other access restrictions.
CVSS risk score (experimental) 6.9 / Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free