PT-2025-13845 · Drupal · Drupal Authenticator Login

Ahmed Raza + 2 · Publicado 2025-03-31 · Atualizado 2025-06-03 · CVE-2025-31681

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal Authenticator Login versions 0.0.0 through 2.0.5

Description The issue is related to a Missing Authorization vulnerability in Drupal Authenticator Login, which allows Forceful Browsing.

Recommendations For versions 0.0.0 through 2.0.5, update to version 2.0.6 or later to resolve the issue.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-31681

DRUPAL-CONTRIB-2025-009

GHSA-JWPX-6C4P-Q4JQ

Produtos afetados

Drupal Authenticator Login

Referências · 8

• https://t.me/cvenotify/124382 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-jwpx-6c4p-q4jq · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-31681 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1906826473123582061 · Publicação no Twitter
• https://drupal.org/sa-contrib-2025-009 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-31681 · Nota de Segurança
• https://twitter.com/dailycve/status/1929692176570835316 · Publicação no Twitter
• https://git.drupalcode.org/project/alogin · Nota