1. Home
  2. CVE Database
  3. CVE-2022-25270
MEDIUM · 6.5

CVE-2022-25270

The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not author...

Vulnerability Description

The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
DrupalDrupal>= 9.2.0, < 9.2.13

Related Weaknesses (CWE)

CWE-863

References

FAQ

What is CVE-2022-25270?

CVE-2022-25270 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not author...

How severe is CVE-2022-25270?

CVE-2022-25270 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-25270?

Check the references section above for vendor advisories and patch information. Affected products include: Drupal Drupal.