CVE-2022-25273

CWE-20 — Improper Input Validation7 documents5 sources
Severity
7.5HIGH
EPSS
0.3%
top 48.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Drupal CoreDrupal Drupal
Timeline
PublishedApr 26

Description

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5drupal/core9.3 — 9.3.12+1
▶Packagistdrupal/core8.0.0 — 9.2.18+1
▶NVDdrupal/drupal8.0.0 — 9.2.18+1

🔴Vulnerability Details

5
GHSA
Improper input validation in Drupal core↗2023-04-26
▶
OSV
CVE-2022-25273: Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation↗2023-04-26
▶
CVEList
CVE-2022-25273: Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation↗2023-04-26
▶
OSV
Improper input validation in Drupal core↗2023-04-26
▶
OSV
CVE-2022-25273: Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation↗2022-04-20
▶

📋Vendor Advisories

1
Drupal
Drupal core - Moderately critical - Improper input validation - SA-CORE-2022-008↗2022-04-20
▶
CVE-2022-25273 (HIGH CVSS 7.5) | Drupal core's form API has a vulner | cvebase.io