DRUPAL-CONTRIB-2022-045unknown
DRUPAL-CONTRIB-2022-045
No CVE assignedCheck your stack
The advisory, in context
The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal. The developers (user) can view API keys for their respective Apps.
The module discloses information by allowing attackers to view cached information of API Keys from the browser cache for a limited time frame after the user login on the same computer.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/apigee_edge Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 1.26.0
Fixed in 1.26.0
Ecosystem versions
From 2.0.0 before 2.0.3
Fixed in 2.0.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.0"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<1.26.0"
}
},
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.3"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">=2.0.0 <2.0.3"
}
}
],
"versions": []
}