| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/core | ≥ 10.6.0, < 10.6.11≥ 11.0.0, < 11.1.0≥ 11.1.0, < 11.2.0≥ 11.2.0, < 11.2.14≥ 11.3.0, < 11.3.12< 10.5.12 | 10.6.1111.1.011.2.011.2.1411.3.1210.5.12 |
| drupal | ≥ 10.6.0, < 10.6.11≥ 11.0.0, < 11.2.14≥ 11.3.0, < 11.3.12< 10.5.12 | 10.6.1111.2.1411.3.1210.5.12 |
The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery.
The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free