CVE-2022-25275
7 documents5 sources
Severity
7.5HIGH
EPSS
0.4%
top 40.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 26
Description
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9)…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6
Affected Packages3 packages
🔴Vulnerability Details
5OSV▶
CVE-2022-25275: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating↗2023-04-26
CVEList▶
CVE-2022-25275: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating↗2023-04-26
OSV▶
CVE-2022-25275: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating↗2022-07-20