| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| drupal/ai | ≥ 1.5.0, < 1.5.2< 1.4.11 | 1.5.21.4.11 |
This module provides a framework for integrating AI providers and features into Drupal.
Audio for every speech-to-text request is written to the same file in the temporary directory and does not delete it afterwards. As a result, an attacker who can read the site's temporary directory could get the audio that another user sent for transcription.
This vulnerability is mitigated by the fact that the attacker needs read access to the temporary directory, either through the server (for example a shared hosting account) or through a module or custom code that exposes temporary files to other users. Drupal core's system.temporary route only serves temporary files to the user who owns them.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン