PT-2025-28955 · Drupal · Drupal Mail Login

Damien Mckenna + 3 · Published 2025-07-09 · Updated 2025-08-27 · CVE-2025-7393

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal Mail Login versions 3.0.0 through 3.1.x Drupal Mail Login versions 4.0.0 through 4.1.x

Description An improper restriction of excessive authentication attempts exists in Drupal Mail Login, allowing for brute force attacks.

Recommendations Update Drupal Mail Login to version 3.2.0 or later. Update Drupal Mail Login to version 4.2.0 or later.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2025-7393

DRUPAL-CONTRIB-2025-088

Affected Products

Drupal Mail Login

References · 6

• https://drupal.org/sa-contrib-2025-088 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7393 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7393 · Vendor Advisory
• https://twitter.com/CVEnew/status/1947339045115154565 · Twitter Post
• https://twitter.com/drupalaid/status/1942992435413684401 · Twitter Post
• https://t.me/cveNotify/133684 · Telegram Post