CVE-2022-25270

EUVD-2022-0877
The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
Affected Products (NVD)
VendorProductVersion
drupaldrupal
9.2.0 ≤
𝑥
< 9.2.13
drupaldrupal
9.3.0 ≤
𝑥
< 9.3.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.drupal.org/sa-core-2022-004
https://www.drupal.org/sa-core-2022-004