Block Ajax
Monthly
Object injection in the Drupal Block AJAX module, affecting versions 0.0.0 through 3.0.2, allows remote attackers to influence dynamically determined object attributes through the module's AJAX request-handling path, with a CVSS 3.1 score of 9.8 indicating high confidentiality, integrity and availability impact. The assessed vector assumes network reachability, low complexity, no privileges and no user interaction, but the available sources do not confirm whether a specific Drupal permission, authenticated session or non-default configuration is required. No public exploit is identified at time of analysis, EPSS is 0.19% (9th percentile), the vendor fix is Block AJAX 3.0.2, and the vuln.today priority label is act_now.
Object injection in the Drupal Block AJAX module, affecting versions 0.0.0 through 3.0.2, allows remote attackers to influence dynamically determined object attributes through the module's AJAX request-handling path, with a CVSS 3.1 score of 9.8 indicating high confidentiality, integrity and availability impact. The assessed vector assumes network reachability, low complexity, no privileges and no user interaction, but the available sources do not confirm whether a specific Drupal permission, authenticated session or non-default configuration is required. No public exploit is identified at time of analysis, EPSS is 0.19% (9th percentile), the vendor fix is Block AJAX 3.0.2, and the vuln.today priority label is act_now.