Skip to content
OpenAdvisories
Medium WID-SEC-2025-0414 3 CVEs

Drupal Core: Mehrere Schwachstellen

Published Feb 19, 2025 · Updated Apr 1, 2025 · Revision 3 · de-DE

Platform: Windows

Summary

Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten, um die Authentifizierung zu umgehen und um Daten zu manipulieren.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 3

  • High 7.5
    CVE-2025-31674

    Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 1…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.1
    CVE-2025-3057

    Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 4.6
    CVE-2025-31673

    Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

    Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

    Drupal Drupal core drupal/core Web / CMS Packagist

Revision history

  1. #3

    CVE's ergänzt

  2. #2

    CVE ergänzt

  3. #1

    Initiale Fassung

References