Skip to content
OpenAdvisories
Medium WID-SEC-2025-0496 3 CVEs

Drupal: Mehrere Schwachstellen

Published Mar 5, 2025 · Updated Mar 31, 2025 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, oder Sicherheitsvorkehrungen zu umgehen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 3

  • High 8.1
    CVE-2025-31694

    Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023

    Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • High 7.5
    CVE-2025-31692

    AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.6
    CVE-2025-31693

    AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References