CVE-2022-25271

2022-02-1600:00:00

CWE-20

drupal

www.cve.org

drupal core

form api

vulnerability

input validation

attacker

sensitive data

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

55.6%

JSON

Drupal core’s form API has a vulnerability where certain contributed or custom modules’ forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

CNA Affected

[
  {
    "vendor": "Drupal",
    "product": "Core",
    "versions": [
      {
        "version": "9.3.x",
        "status": "affected",
        "lessThan": "9.3.6",
        "versionType": "custom"
      },
      {
        "version": "9.2.x",
        "status": "affected",
        "lessThan": "9.2.13",
        "versionType": "custom"
      },
      {
        "version": "7.x",
        "status": "affected",
        "lessThan": "7.88",
        "versionType": "custom"
      }
    ]
  }
]