PT-2025-13853 · Drupal · Drupal General Data Protection Regulation

Greg Knaddison + 3 · Published 2025-03-31 · Updated 2025-04-01 · CVE-2025-31689

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal General Data Protection Regulation versions 0.0.0 through 3.0.1, versions 3.1.0 through 3.1.2

Description The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows for Cross Site Request Forgery. This is a type of attack where an attacker tricks a user into performing unintended actions on a web application that the user is authenticated to.

Recommendations For versions 0.0.0 through 3.0.1, update to version 3.0.1 or later. For versions 3.1.0 through 3.1.2, update to version 3.1.2 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-31689

DRUPAL-CONTRIB-2025-018

GHSA-JV6R-MJ9P-9XFF

Affected Products

Drupal General Data Protection Regulation

References · 8

• https://osv.dev/vulnerability/CVE-2025-31689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31689 · Security Note
• https://osv.dev/vulnerability/GHSA-jv6r-mj9p-9xff · Vendor Advisory
• https://git.drupalcode.org/project/gdpr · Note
• https://t.me/cvedetector/21673 · Telegram Post
• https://twitter.com/CVEnew/status/1906832641736798401 · Twitter Post
• https://git.drupalcode.org/project/gdpr/-/commit/d53f1cf1394c41c8885faaaaf576965161676e1f · Note
• https://drupal.org/sa-contrib-2025-018 · Note