GitHub Advisoryadvisory · Packagist

GHSA-fmfv-x8mp-5767 Improper input validation in Drupal core

HIGH Published 2022-02-18 Modified 2022-03-01 Official page ↗
Aliases
CVE-2022-25271
Ecosystem
Packagist
Packages
drupal/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2022-03-01

Affected packages

• Packagist drupal/core: >= 9.3.0, < 9.3.6 → fixed in 9.3.6 • Packagist drupal/core: >= 8.0.0, < 9.2.13 → fixed in 9.2.13 • Packagist drupal/core: >= 7.0.0, < 7.88 → fixed in 7.88

Description

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

Related

Alias · CVE (1)

  • CVE-2022-25271 Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References