Eca Helper
Monthly
Information disclosure in the Drupal ECA Helper contrib module affects all released versions (*.*), letting a remote attacker who already holds a high-privilege authenticated account on the Drupal site reach data that should not be exposed to them. The assessed severity is CVSS 5.9 (moderate) with high attack complexity (AC:H) and a privileged-account precondition (PR:H), and the impact is scoped to confidentiality only. The flaw is not in CISA KEV, EPSS is 0.14% (3rd percentile), no public exploit identified at time of analysis, and the priority decision is this_month rather than immediate action.
Information disclosure in the Drupal ECA Helper contrib module affects all released versions (*.*), letting a remote attacker who already holds a high-privilege authenticated account on the Drupal site reach data that should not be exposed to them. The assessed severity is CVSS 5.9 (moderate) with high attack complexity (AC:H) and a privileged-account precondition (PR:H), and the impact is scoped to confidentiality only. The flaw is not in CISA KEV, EPSS is 0.14% (3rd percentile), no public exploit identified at time of analysis, and the priority decision is this_month rather than immediate action.