PT-2023-12782 · Drupal · Drupal

Kristiaan Van Den Eynde · Publicado 2023-04-26 · Atualizado 2024-03-06 · CVE-2022-25274

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal version 9.3

Description The issue arises from the incomplete integration of the generic entity access API for entity revisions with existing permissions in Drupal 9.3. This results in possible access bypass for users who have access to use revisions of content generally but do not have access to individual items of node and media content. The vulnerability only affects sites using Drupal's revision system.

Recommendations For Drupal version 9.3, update to a version that fully integrates the entity access API with existing permissions to prevent access bypass. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BIT-DRUPAL-2022-25274

CVE-2022-25274

DRUPAL-CORE-2022-009

GHSA-7JR4-HGQX-VWGQ

Produtos afetados

Drupal

Referências · 11

• https://github.com/drupal/core · Nota
• https://osv.dev/vulnerability/BIT-drupal-2022-25274 · Aviso do Fabricante
• https://t.me/cibsecurity/62907 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2022-25274 · Nota de Segurança
• https://ubuntu.com/security/CVE-2022-25274 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25274 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-25274 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-25274 · Nota de Segurança
• https://drupal.org/sa-core-2022-009 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7jr4-hgqx-vwgq · Aviso do Fabricante
• https://t.me/cvenotify/50049 · Publicação no Telegram