GitHub Advisoryadvisory · Packagist
GHSA-g36h-4jr6-qmm9 Improper input validation in Drupal core
HIGH
Official page ↗
- Aliases
- CVE-2022-25273
- Ecosystem
- Packagist
- Packages
- drupal/core
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-20
- Reviewed
- 2023-04-26
Affected packages
• Packagist drupal/core: >= 8.0.0, < 9.2.18 → fixed in 9.2.18
• Packagist drupal/core: >= 9.3.0, < 9.3.12 → fixed in 9.3.12
Description
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
Drupal 7 is not affected.
Related
Alias · CVE (1)
- CVE-2022-25273 Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness