—
DRUPAL-CONTRIB-2025-047
Details
The Restrict route by IP module provides an interface to manage route restriction by IP address.
The module doesn't sufficiently protect certain routes from CSRF attacks.
This vulnerability is mitigated by the fact that you need to know the route machine name.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/restrict_route_by_ip
Introduced in:
0Fixed in: 1.3.0Upgrade drupal/restrict_route_by_ip to 1.3.0 or newer (ecosystem packagist:https://packages.drupal.org/8).