GitHub Advisoryadvisory · Packagist

GHSA-cfh2-7f6h-3m85 Access bypass in Drupal Core

MEDIUM Published 2023-04-24 Modified 2023-05-09 Official page ↗

Aliases: CVE-2022-25278
Ecosystem: Packagist
Packages: drupal/core
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Reviewed: 2023-04-24

Affected packages

• Packagist drupal/core: >= 8.0.0, < 9.3.19 → fixed in 9.3.19 • Packagist drupal/core: >= 9.4.0, < 9.4.3 → fixed in 9.4.3

Description

Drupal core form API evaluates form element access incorrectly. This can lead to a user being able to alter data they should not have access to.

Related

Alias · CVE (1)

CVE-2022-25278 Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. vulnerability

References