—
DRUPAL-CONTRIB-2023-003
Details
The Media Library Block module allows you to render a media entity in a block.
The module does not properly check media access in some circumstances. This may result in unauthorized users (including anonymous users) seeing media items they are not authorized to access if a block containing a restricted media item is placed on the page.
Administrators may mitigate this vulnerability by removing blocks referencing media items that have access restrictions.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/media_library_block
Introduced in:
0Fixed in: 1.0.4Upgrade drupal/media_library_block to 1.0.4 or newer (ecosystem packagist:https://packages.drupal.org/8).