Lucene search

DrupalCVE-2022-25271

HistoryFeb 16, 2022 - 11:15 p.m.

CVE-2022-25271

2022-02-1623:15:11

CWE-20

drupal

web.nvd.nist.gov

872

cve

2022

25271

drupal

core

form api

vulnerability

input validation

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.2

Confidence

High

EPSS

0.002

Percentile

52.4%

JSON

Drupal core’s form API has a vulnerability where certain contributed or custom modules’ forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

Affected configurations

Nvd

Node

drupaldrupalRange7.0.0–7.88

drupaldrupalRange9.2.0–9.2.13

drupaldrupalRange9.3.0–9.3.6

Node

fedoraprojectfedoraMatch35

fedoraprojectfedoraMatch36

VendorProductVersionCPE
drupaldrupal*cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
fedoraprojectfedora35cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
fedoraprojectfedora36cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
drupal	drupal	*	cpe:2.3:a:drupal:drupal::::::::
fedoraproject	fedora	35	cpe:2.3:o:fedoraproject:fedora:35:::::::*
fedoraproject	fedora	36	cpe:2.3:o:fedoraproject:fedora:36:::::::*

CNA Affected

[
  {
    "vendor": "Drupal",
    "product": "Core",
    "versions": [
      {
        "version": "9.3.x",
        "status": "affected",
        "lessThan": "9.3.6",
        "versionType": "custom"
      },
      {
        "version": "9.2.x",
        "status": "affected",
        "lessThan": "9.2.13",
        "versionType": "custom"
      },
      {
        "version": "7.x",
        "status": "affected",
        "lessThan": "7.88",
        "versionType": "custom"
      }
    ]
  }
]