PT-2023-12782 · Drupal · Drupal

Kristiaan Van Den Eynde · Published 2023-04-26 · Updated 2024-03-06 · CVE-2022-25274

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal version 9.3

Description The issue arises from the incomplete integration of the generic entity access API for entity revisions with existing permissions in Drupal 9.3. This results in possible access bypass for users who have access to use revisions of content generally but do not have access to individual items of node and media content. The vulnerability only affects sites using Drupal's revision system.

Recommendations For Drupal version 9.3, update to a version that fully integrates the entity access API with existing permissions to prevent access bypass. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-DRUPAL-2022-25274

CVE-2022-25274

DRUPAL-CORE-2022-009

GHSA-7JR4-HGQX-VWGQ

Affected Products

Drupal

References · 11

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25274 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-drupal-2022-25274 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25274 · Vendor Advisory
• https://drupal.org/sa-core-2022-009 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25274 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-25274 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25274 · Security Note
• https://osv.dev/vulnerability/GHSA-7jr4-hgqx-vwgq · Vendor Advisory
• https://github.com/drupal/core · Note
• https://t.me/cibsecurity/62907 · Telegram Post
• https://t.me/cvenotify/50049 · Telegram Post