CVE-2022-25275
published 2023-04-26CVE-2022-25275: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.67%
47.2th percentile
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| drupal | core | >= 7 < 7.91 | 7.91 |
| drupal | core | >= 7.0.0 < 7.91 | 7.91 |
| drupal | core | >= 8.0.0 < 9.3.19 | 9.3.19 |
| drupal | core | >= 9.3 < 9.3.19 | 9.3.19 |
| drupal | core | >= 9.4 < 9.4.3 | 9.4.3 |
| drupal | core | >= 9.4.0 < 9.4.3 | 9.4.3 |
| drupal | drupal | >= 7.0 < 7.91 | 7.91 |
| drupal | drupal | >= 8.0.0 < 9.3.19 | 9.3.19 |
| drupal | drupal | >= 9.4.0 < 9.4.3 | 9.4.3 |
| drupal | drupal_core | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-25275: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating
osv·2023-04-26·CVSS 7.5
CVE-2022-25275 [HIGH] CVE-2022-25275: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this s
OSV
Drupal core Information Disclosure vulnerability
osv·2022-08-06
CVE-2022-25275 [HIGH] Drupal core Information Disclosure vulnerability
Drupal core Information Disclosure vulnerability
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system.
Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability.
This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) `$config['image.settings']['allow_insecure_derivatives']` or (Drupal 7) `$conf['image_allow_insecure_derivatives']` to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI.
Some
GHSA
Drupal core Information Disclosure vulnerability
ghsa·2022-08-06
CVE-2022-25275 [HIGH] Drupal core Information Disclosure vulnerability
Drupal core Information Disclosure vulnerability
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system.
Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability.
This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) `$config['image.settings']['allow_insecure_derivatives']` or (Drupal 7) `$conf['image_allow_insecure_derivatives']` to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI.
Some
OSV
CVE-2022-25275: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating
osv·2022-07-20
CVE-2022-25275 CVE-2022-25275: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system.
Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability.
This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) `$config['image.settings']['allow_insecure_derivatives']` or (Drupal 7) `$conf['image_allow_insecure_derivatives']` to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI.
Some sites may require configuration changes following
Drupal
Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012
vendor_drupal·2022-07-20
CVE-2022-25275 [MEDIUM] Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012
Title: Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012
Vulnerability Type: Information Disclosure
Description: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-04-26
Published