Skip to content
OpenAdvisories
Medium WID-SEC-2025-0690 3 CVEs

Drupal: Mehrere Schwachstellen

Published Apr 2, 2025 · Updated Apr 2, 2025 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Sicherheitsmaßnahmen zu umgehen und Cross-Site-Scripting-Schwachstellen auszuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 3

  • Medium 5.4
    CVE-2025-3130

    Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obfuscate: from 0.0.0 before 2.0.1.

    Drupal Obfuscate drupal/obfuscate Packagist
  • Medium 4.8
    CVE-2025-3129

    Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.

    Drupal Access code drupal/access_code Packagist
  • Medium 4.8
    CVE-2025-31476

    tarteaucitron.js allows url scheme injection via unfiltered inputs

    tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as java…

    amauric tarteaucitron.js tarteaucitronjs drupal/tacjs npm Packagist

Revision history

  1. #1

    Initiale Fassung

References