Vulnerability advisory
CVE-2022-25276
Also known as BIT-drupal-2022-25276DRUPAL-CORE-2022-015GHSA-4wfq-jc9h-vpcx
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/drupal/drupal ↗ | |
| 698ee686c23de8c97d7e0601cf745b220d54f4e1 to before 32680a4aef16035fd6c90014761dcad8de628120 | 32680a4aef16035fd6c90014761dcad8de628120 |
| 970c1b5cfa946f683de326a3f252b5371a42186a to before bf401c8d5c5a88d442ac7e95a9eb059d123a771c | bf401c8d5c5a88d442ac7e95a9eb059d123a771c |
Also listed as affected (13)
| |
Description
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.