Data Field
Monthly
Stored cross-site scripting in the Drupal Data field contrib module (versions 0.0.0 through 2.0.14) lets an attacker with a privileged content-editing role persist markup inside a Data field that executes in the browser of another user who later views the rendered page. Only sites that have installed and enabled this optional contrib module are exposed; Drupal core is unaffected, and the vendor CVSS score is 3.5 (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N), with our assessment corroborating low severity. EPSS is 0.17% (6th percentile), no CISA KEV listing, and no public exploit identified at time of analysis; a vendor patch is available per the Drupal advisory and the priority decision is monitor.
Forceful browsing via missing authorization in the Drupal Data field contributed module (versions up to 2.0.13) exposes field data to unauthenticated network access. The module fails to enforce access control checks before serving field content, allowing an attacker to directly request protected data resources by crafting or guessing their URLs. A vendor patch is available; no public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Drupal Data field contrib module (versions 0.0.0 through 2.0.14) lets an attacker with a privileged content-editing role persist markup inside a Data field that executes in the browser of another user who later views the rendered page. Only sites that have installed and enabled this optional contrib module are exposed; Drupal core is unaffected, and the vendor CVSS score is 3.5 (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N), with our assessment corroborating low severity. EPSS is 0.17% (6th percentile), no CISA KEV listing, and no public exploit identified at time of analysis; a vendor patch is available per the Drupal advisory and the priority decision is monitor.
Forceful browsing via missing authorization in the Drupal Data field contributed module (versions up to 2.0.13) exposes field data to unauthenticated network access. The module fails to enforce access control checks before serving field content, allowing an attacker to directly request protected data resources by crafting or guessing their URLs. A vendor patch is available; no public exploit or active exploitation has been identified at time of analysis.