Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
CVE-2022-25273 - High Severity Vulnerability
Subtree split of drupal's /core directory
Dependency Hierarchy: - :x: **drupal/core-8.3.6** (Vulnerable Library)
Found in base branch: master
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
Publish Date: 2023-04-26
URL: CVE-2022-25273
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.drupal.org/sa-core-2022-008
Release Date: 2023-04-26
Fix Resolution: 9.2.18, 9.3.12
Step up your Open Source Security Game with Mend here