Skip to content
OpenAdvisories
Unscored DRUPAL-CONTRIB-2021-040

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. The module doe…

Published Sep 22, 2021 · Updated Sep 10, 2026 · Assigned by DRUPAL

Description

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

The module does not use CSRF tokens to protect routes for saving menu configurations.

This vulnerability can be exploited by an anonymous user.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/tb_megamenu < 1.4.0 1.4.0 DRUPAL-CONTRIB-2021-040

References