Drupal Security TeamDRUPAL-SA-CORE-2022-003Drupal core - Moderately critical - Improper input validation - SA-CORE-2022-003
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
48.6%
Drupal core’s form API has a vulnerability where certain contributed or custom modules’ forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data. This advisory is not covered by Drupal Steward.
Affected configurations
References
www.drupal.org/project/drupal/releases/7.88
www.drupal.org/project/drupal/releases/9.2.13
www.drupal.org/project/drupal/releases/9.3.6
www.drupal.org/psa-2021-06-29
www.drupal.org/user/1632364
www.drupal.org/user/1852732
www.drupal.org/user/255969
www.drupal.org/user/35821
www.drupal.org/user/395439
www.drupal.org/user/65776
www.drupal.org/user/693738
www.drupal.org/user/78040
www.drupal.org/user/85586
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
48.6%