PT-2023-12784 · Drupal · Drupal

Pierre Rudloff + 1 · Published 2023-04-24 · Updated 2024-03-06 · CVE-2022-25278

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal (affected versions not specified)

Description The Drupal core form API evaluates form element access incorrectly under certain circumstances. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BIT-DRUPAL-2022-25278

CVE-2022-25278

DRUPAL-CORE-2022-013

GHSA-CFH2-7F6H-3M85

Affected Products

Drupal

References · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25278.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25278 · Security Note
• https://osv.dev/vulnerability/GHSA-cfh2-7f6h-3m85 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-25278 · Security Note
• https://drupal.org/sa-core-2022-013 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25278 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-drupal-2022-25278 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25278 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25278 · Vendor Advisory
• https://github.com/drupal/core · Note
• https://t.me/cibsecurity/62895 · Telegram Post
• https://t.me/cvenotify/49109 · Telegram Post