Examples For Developers
Monthly
Unbounded resource allocation in the Drupal contrib module Examples for Developers (versions 0.0.0 through 4.0.7) allows a low-privileged authenticated user to cause excessive allocation and degrade service availability, with the CVSS 4.3 vector reflecting availability-only impact. The module is an optional developer-demonstration package that must be installed and enabled, which sharply limits exposure on production sites, and the available intelligence shows no active exploitation and no public exploit identified at time of analysis (EPSS 0.15%, SSVC exploitation none). A vendor patch is available.
Missing Authorization in Drupal's Examples for Developers module (versions 0.0.0 through 4.0.5) permits forceful browsing by an already highly-privileged authenticated attacker, exposing restricted paths with limited confidentiality and integrity impact. All available signals converge on minimal real-world risk: CVSS scores 3.3 (Low), EPSS sits at 0.14% (4th percentile), SSVC reports no known exploitation and non-automatable attack conditions, and neither active exploitation nor public proof-of-concept code has been identified. A vendor patch is available at version 4.0.6.
Unbounded resource allocation in the Drupal contrib module Examples for Developers (versions 0.0.0 through 4.0.7) allows a low-privileged authenticated user to cause excessive allocation and degrade service availability, with the CVSS 4.3 vector reflecting availability-only impact. The module is an optional developer-demonstration package that must be installed and enabled, which sharply limits exposure on production sites, and the available intelligence shows no active exploitation and no public exploit identified at time of analysis (EPSS 0.15%, SSVC exploitation none). A vendor patch is available.
Missing Authorization in Drupal's Examples for Developers module (versions 0.0.0 through 4.0.5) permits forceful browsing by an already highly-privileged authenticated attacker, exposing restricted paths with limited confidentiality and integrity impact. All available signals converge on minimal real-world risk: CVSS scores 3.3 (Low), EPSS sits at 0.14% (4th percentile), SSVC reports no known exploitation and non-automatable attack conditions, and neither active exploitation nor public proof-of-concept code has been identified. A vendor patch is available at version 4.0.6.