Islandora
Monthly
Missing authorization in the Islandora digital repository framework for Drupal (versions 0.0.0 through 2.19.0) lets unauthenticated, network-positioned attackers reach protected resources by requesting their paths directly - a forceful browsing bypass of access control. Impact is limited to low-severity confidentiality disclosure with no integrity or availability effect, and the trigger specifics (which endpoints or object states bypass the check) are not described in the available sources. No public exploit code and no active exploitation are confirmed; EPSS is 0.14% (3rd percentile), CISA SSVC records Exploitation: none and Automatable: no, and the vendor has released a fix, so priority is monitoring rather than emergency response.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal Islandora due to improper neutralization of user input during web page generation. All versions of Islandora from 0.0.0 through 2.17.4 are affected, allowing attackers to inject and execute malicious JavaScript in the context of affected users' browsers. Exploitation enables session hijacking, credential theft, malware distribution, and defacement of the repository interface.
Missing authorization in the Islandora digital repository framework for Drupal (versions 0.0.0 through 2.19.0) lets unauthenticated, network-positioned attackers reach protected resources by requesting their paths directly - a forceful browsing bypass of access control. Impact is limited to low-severity confidentiality disclosure with no integrity or availability effect, and the trigger specifics (which endpoints or object states bypass the check) are not described in the available sources. No public exploit code and no active exploitation are confirmed; EPSS is 0.14% (3rd percentile), CISA SSVC records Exploitation: none and Automatable: no, and the vendor has released a fix, so priority is monitoring rather than emergency response.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal Islandora due to improper neutralization of user input during web page generation. All versions of Islandora from 0.0.0 through 2.17.4 are affected, allowing attackers to inject and execute malicious JavaScript in the context of affected users' browsers. Exploitation enables session hijacking, credential theft, malware distribution, and defacement of the repository interface.