PT-2025-44358 · Drupal · Drupal Currency

Juraj Nemec + 2 · Published 2025-09-24 · Updated 2025-10-30 · CVE-2025-10930

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Drupal Currency versions prior to 3.5.0

Description A Cross-Site Request Forgery (CSRF) issue exists in Drupal Currency. This allows attackers to perform actions on behalf of authenticated users without their knowledge. CSRF occurs when a malicious website, email, or other communication tricks a user's browser into sending a request to a vulnerable web application.

Recommendations Update Drupal Currency to version 3.5.0 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-10930

DRUPAL-CONTRIB-2025-110

GHSA-27FV-RPGJ-4C6M

Affected Products

Drupal Currency

References · 9

• https://drupal.org/sa-contrib-2025-110 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10930 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10930 · Vendor Advisory
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2025-110 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-27fv-rpgj-4c6m · Vendor Advisory
• https://t.me/cveNotify/140952 · Telegram Post
• https://twitter.com/CVEnew/status/1983678035636166690 · Twitter Post
• https://t.me/cveNotify/140913 · Telegram Post
• https://t.me/CVEtracker/36140 · Telegram Post