{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c10.0.13 || \u003e=10.1.0 \u003c10.1.6"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/social"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c10.0.13"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=10.1.0 \u003c10.1.6"
          },
          "events": [
            {
              "introduced": "10.1.0"
            },
            {
              "fixed": "10.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/user/1868952"
      ],
      "name": "Alexander Varwijk"
    },
    {
      "contact": [
        "https://www.drupal.org/user/2723261"
      ],
      "name": "Robert Ragas"
    },
    {
      "contact": [
        "https://www.drupal.org/user/2314038"
      ],
      "name": "Ronald te Brake"
    }
  ],
  "details": "Open Social is a Drupal distribution for online communities.\n\nThe included social\\_magic\\_login module doesn\u0027t sufficiently validate magic login URLs for user accounts. The lack of validation makes it possible for an adversary to forge valid login URLs and login to such an account.\n\nThis vulnerability is mitigated by the fact the module social\\_magic\\_login needs to be enabled.",
  "id": "DRUPAL-CONTRIB-2021-011",
  "modified": "2023-08-11T17:22:44.000Z",
  "published": "2021-06-02T16:51:10.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2021-011"
    }
  ],
  "schema_version": "1.7.0"
}