CVE-2022-25278
published 2023-04-26CVE-2022-25278: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.59%
43.8th percentile
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| drupal | core | >= 8.0.0 < 9.3.19 | 9.3.19 |
| drupal | core | >= 9.3 < 9.3.19 | 9.3.19 |
| drupal | core | >= 9.4 < 9.4.3 | 9.4.3 |
| drupal | core | >= 9.4.0 < 9.4.3 | 9.4.3 |
| drupal | drupal | >= 8.0.0 < 9.3.19 | 9.3.19 |
| drupal | drupal | >= 9.4.0 < 9.4.3 | 9.4.3 |
| drupal | drupal_core | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
osv6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Drupal
Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013
vendor_drupal·2022-07-20
CVE-2022-25278 [MEDIUM] Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013
Title: Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013
Vulnerability Type: Access Bypass
Description: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected. This advisory is not covered by Drupal Steward .
Solution: Install the latest version: If you are using Drupal 9.4, update to Drupal 9.4.3 . If you are using Drupal 9.3, update to Drupal 9.3.19 . All versions of Drupal 9 prior to 9.3.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life . Drupal 7 c
OSV
CVE-2022-25278: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly
osv·2023-04-26·CVSS 6.5
CVE-2022-25278 [MEDIUM] CVE-2022-25278: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
GHSA
Access bypass in Drupal Core
ghsa·2023-04-24
CVE-2022-25278 [MEDIUM] Access bypass in Drupal Core
Access bypass in Drupal Core
Drupal core form API evaluates form element access incorrectly. This can lead to a user being able to alter data they should not have access to.
OSV
Access bypass in Drupal Core
osv·2023-04-24
CVE-2022-25278 [MEDIUM] Access bypass in Drupal Core
Access bypass in Drupal Core
Drupal core form API evaluates form element access incorrectly. This can lead to a user being able to alter data they should not have access to.
OSV
CVE-2022-25278: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly
osv·2022-07-20
CVE-2022-25278 CVE-2022-25278: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to.
No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
This advisory is not covered by [Drupal Steward](/steward).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-04-26
Published