DRUPAL-CONTRIB-2023-053unknown
DRUPAL-CONTRIB-2023-053
No CVE assignedCheck your stack
The advisory, in context
The Xsendfile module enables fast transfer for private files in Drupal.
In order to control private file downloads, the module overrides ImageStyleDownloadController, for which a vulnerability was disclosed in SA-CORE-2023-005. The Xsendfile module was still based on an insecure version of ImageStyleDownloadController.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/xsendfile Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 1.2.0
Fixed in 1.2.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.0"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<1.2.0"
}
}
],
"versions": []
}