DRUPAL-CONTRIB-2021-030

    Dashboard / Vulnerabilities / DRUPAL-CONTRIB-2021-030

    DRUPAL-CONTRIB-2021-030

    Published: 22 Sept 2021Last Modified: 10 Sept 2026

    Summary:

    Details: This module enables you to create an individual hash for each user. These hashes can be used for authentication instead of the user's password, e.g. for views exporters. The module doesn't sufficiently invalidate page output when the page\_cache module is used. This vulnerability is mitigated by the fact that an attacker must have a user hash that grants access to specific content and the attack must be timed to the reset of the page cache.

    References: https://www.drupal.org/sa-contrib-2021-030

    Affected packages

    Package

    Name: drupal/user_hash

    Purl: pkg:composer/drupal/user_hash?repository_url=https:%2F%2Fpackages.drupal.org%2F8

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.0.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DRUPAL-CONTRIB-2021-030 | CVE-DB