Vulnerability advisory
CVE-2022-25273
Also known as BIT-drupal-2022-25273DRUPAL-CORE-2022-008GHSA-g36h-4jr6-qmm9
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/drupal/drupal ↗ | |
| 35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before 416eae2698e7c8b5588a7b7ebc88df842d9324cc | 416eae2698e7c8b5588a7b7ebc88df842d9324cc |
| 698ee686c23de8c97d7e0601cf745b220d54f4e1 to before aa750f98c476ab867f6c6a14bbafcd2e98814512 | aa750f98c476ab867f6c6a14bbafcd2e98814512 |
Also listed as affected (24)
| |
Description
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.