| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/entity | < 1.8.0 | 1.8.0 |
| entity api | ≥ 7.x-1.0, ≤ 7.x-1.11≥ 8.x-0.1, < 8.x-1.8 | 8.x-1.8 |
The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties.
The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability.
This vulnerability is mitigated by the fact that the JSON:API module must be enabled in combination with the Entity API module.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free