Medium WID-SEC-2025-0847 7 CVEs

Drupal Plugins Mehrere Schwachstellen

Published Apr 16, 2025 · Updated Apr 16, 2025 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, einen Denial of Service auszuführen oder nicht spezifizierte Angriffe durchzuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 7

Medium 6.5

CVE-2025-3733

baguetteBox.js - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-034

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal baguetteBox.Js allows Cross-Site Scripting (XSS).This issue affects baguetteBox.Js: from 0.0.0 before 2.0.4, from 3.0.0 before 3.0.1.

Drupal baguetteBox.js drupal/baguettebox Packagist

Apr 16, 2025
Medium 5.9

CVE-2025-3734

Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.

Drupal Stage File Proxy drupal/stage_file_proxy Packagist

Apr 16, 2025
Medium 5.9

CVE-2025-3735

Panelizer (obsolete) - Critical - Unsupported - SA-CONTRIB-2025-036

Vulnerability in Drupal Panelizer (obsolete).This issue affects Panelizer (obsolete): *.*.

Drupal Panelizer (obsolete) drupal/panelizer Packagist

Apr 16, 2025
Medium 5.9

CVE-2025-3736

Simple GTM - Critical - Unsupported - SA-CONTRIB-2025-037

Vulnerability in Drupal Simple GTM.This issue affects Simple GTM: *.*.

Drupal Simple GTM drupal/simple_gtm Packagist

Apr 16, 2025
Medium 5.9

CVE-2025-3737

Google Maps: Store Locator - Critical - Unsupported - SA-CONTRIB-2025-038

Vulnerability in Drupal Google Maps: Store Locator.This issue affects Google Maps: Store Locator: *.*.

Drupal Google Maps: Store Locator drupal/gmap_store_locator Packagist

Apr 16, 2025
Medium 5.9

CVE-2025-3738

Google Optimize - Critical - Unsupported - SA-CONTRIB-2025-039

Vulnerability in Drupal Google Optimize.This issue affects Google Optimize: *.*.

Drupal Google Optimize drupal/google_optimize Packagist

Apr 16, 2025
Medium 5.9

CVE-2025-3739

Drupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040

Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page: *.*.

Drupal Drupal 8 Google Optimize Hide Page drupal/d8_google_optimize_hide_page Web / CMS Packagist

Apr 16, 2025

Revision history

2025-04-16 #1
Initiale Fassung

References

Drupal Security advisories vom 2025-04-16
https://www.drupal.org/sa-contrib-2025-034
Drupal Security advisories vom 2025-04-16
https://www.drupal.org/sa-contrib-2025-035
Drupal Security advisories vom 2025-04-16
https://www.drupal.org/sa-contrib-2025-036
Drupal Security advisories vom 2025-04-16
https://www.drupal.org/sa-contrib-2025-037
Drupal Security advisories vom 2025-04-16
https://www.drupal.org/sa-contrib-2025-038
Drupal Security advisories vom 2025-04-16
https://www.drupal.org/sa-contrib-2025-039
Drupal Security advisories vom 2025-04-16
https://www.drupal.org/sa-contrib-2025-040