Synchronize Composer Json With Contrib Modules
Monthly
Unauthenticated information disclosure in the Drupal contrib module 'Synchronize composer.json With Contrib Modules' allows a remote attacker to read limited sensitive data from any Drupal site where this module is installed and enabled (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Only the confidentiality of the site is affected - there is no integrity or availability impact, no privilege escalation, and no user interaction required; the module is niche developer tooling rather than Drupal core, so the vast majority of Drupal installations are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and EPSS rates the likelihood of exploitation in the next 30 days at 0.25% (15th percentile), consistent with a low-priority reconnaissance-grade leak rather than an urgent, wormable issue.
Unauthenticated information disclosure in the Drupal contrib module 'Synchronize composer.json With Contrib Modules' allows a remote attacker to read limited sensitive data from any Drupal site where this module is installed and enabled (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Only the confidentiality of the site is affected - there is no integrity or availability impact, no privilege escalation, and no user interaction required; the module is niche developer tooling rather than Drupal core, so the vast majority of Drupal installations are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and EPSS rates the likelihood of exploitation in the next 30 days at 0.25% (15th percentile), consistent with a low-priority reconnaissance-grade leak rather than an urgent, wormable issue.