CVE-2022-25273

2023-04-2600:00:00

drupal

www.cve.org

cve-2022-25273

drupal

input validation

vulnerability

attacker

sensitive data

data overwrite

0.001 Low

EPSS

Percentile

19.4%

JSON

Drupal core’s form API has a vulnerability where certain contributed or custom modules’ forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

CNA Affected

[
  {
    "vendor": "Drupal",
    "product": "Core",
    "versions": [
      {
        "version": "9.3",
        "status": "affected",
        "lessThan": "9.3.12",
        "versionType": "custom"
      },
      {
        "version": "9.2",
        "status": "affected",
        "lessThan": "9.2.18",
        "versionType": "custom"
      }
    ]
  }
]

References

www.drupal.org/sa-core-2022-008

0.001 Low

EPSS

Percentile

19.4%

JSON

Related for CVELIST:CVE-2022-25273