PT-2025-15835 · Unknown · Eca: Event - Condition - Action

Benji Fisher + 4 · CVE-2025-3131 · Published 2025-04-09 · Updated 2025-04-09

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ECA: Event - Condition - Action versions 0.0.0 through 1.1.12 ECA: Event - Condition - Action versions 2.0.0 through 2.0.16 ECA: Event - Condition - Action versions 2.1.0 through 2.1.7

Description: A Cross-Site Request Forgery (CSRF) issue affects the ECA: Event - Condition - Action module, allowing unauthorized actions to be performed.

Recommendations: For versions 0.0.0 through 1.1.12, update to version 1.1.12 or later. For versions 2.0.0 through 2.0.16, update to version 2.0.16 or later. For versions 2.1.0 through 2.1.7, update to version 2.1.7 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-3131

DRUPAL-CONTRIB-2025-031

Affected Products

Eca: Event - Condition - Action

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3131.json · Exploit
• https://drupal.org/sa-contrib-2025-031 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-3131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3131 · Security Note
• https://git.drupalcode.org/project/eca · Note
• https://t.me/cvenotify/118506 · Telegram Post
• https://drupal.org/project/eca · Note
• https://t.me/cvetracker/21245 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1910050198753067046 · Twitter Post
• https://t.me/cvedetector/22570 · Telegram Post
• https://twitter.com/CVEnew/status/1910073395368108293 · Twitter Post