Dam
Monthly
Missing authorization in the Acquia DAM module for Drupal (all versions from 0.0.0 up to but not including 1.1.5) lets a remote, unauthenticated attacker bypass access controls and retrieve DAM-managed assets and protected resources by requesting them directly - classic forceful browsing against endpoints the module fails to guard. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), no credentials, user interaction, or non-default configuration are stated as required, but impact is confined to unauthorized disclosure with no modification or denial of service. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.31% (22nd percentile), and the vendor-released patch is version 1.1.5 (Drupal SA-CONTRIB-2025-105).
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization in the Acquia DAM module for Drupal (all versions from 0.0.0 up to but not including 1.1.5) lets a remote, unauthenticated attacker bypass access controls and retrieve DAM-managed assets and protected resources by requesting them directly - classic forceful browsing against endpoints the module fails to guard. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), no credentials, user interaction, or non-default configuration are stated as required, but impact is confined to unauthorized disclosure with no modification or denial of service. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.31% (22nd percentile), and the vendor-released patch is version 1.1.5 (Drupal SA-CONTRIB-2025-105).
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.