Data Field
Monthly
Forceful browsing via missing authorization in the Drupal Data field contributed module (versions up to 2.0.13) exposes field data to unauthenticated network access. The module fails to enforce access control checks before serving field content, allowing an attacker to directly request protected data resources by crafting or guessing their URLs. A vendor patch is available; no public exploit or active exploitation has been identified at time of analysis.
Forceful browsing via missing authorization in the Drupal Data field contributed module (versions up to 2.0.13) exposes field data to unauthenticated network access. The module fails to enforce access control checks before serving field content, allowing an attacker to directly request protected data resources by crafting or guessing their URLs. A vendor patch is available; no public exploit or active exploitation has been identified at time of analysis.