PT-2022-1767 · Drupal+1 · Drupal Core+1

Fabian Iwand · Published 2022-02-16 · Updated 2024-03-06 · CVE-2022-25271

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal core (affected versions not specified)

Description The issue is related to insufficient input validation in the Drupal core's form API, which may allow an attacker to inject disallowed values or overwrite data. This could potentially enable the alteration of critical or sensitive data, although affected forms are uncommon. The vulnerability can be exploited by sending specially crafted input to the Drupal core's form API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-01066

BIT-DRUPAL-2022-25271

CVE-2022-25271

DLA-2925-1

DRUPAL-CORE-2022-003

GHSA-FMFV-X8MP-5767

Affected Products

Drupal Core

Red Os

References · 21

• https://osv.dev/vulnerability/DLA-2925-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25271 · Vendor Advisory
• https://drupal.org/sa-core-2022-003 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-25271 · Security Note
• https://osv.dev/vulnerability/BIT-drupal-2022-25271 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fmfv-x8mp-5767 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25271 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25271 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25271 · Vendor Advisory
• http://repo.red-soft.ru/goslinux/7/ic6/os/x86_105 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01066 · Security Note