Skip to content
OpenAdvisories
Medium WID-SEC-2025-0978 10 CVEs

Drupal Erweiterungen: Mehrere Schwachstellen

Published May 7, 2025 · Updated May 19, 2025 · Revision 3 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Dateien zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und Sicherheitsmaßnahmen zu umgehen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 10

  • High 8.8
    CVE-2025-47701

    Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.This issue affects Restrict route by IP: from 0.0.0 before 1.3.0.

    Drupal Restrict route by IP drupal/restrict_route_by_ip Packagist
  • High 8.8
    CVE-2025-47708

    Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • High 7.5
    CVE-2025-47707

    Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • High 7.4
    CVE-2025-47710

    Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • Medium 6.5
    CVE-2025-47709

    Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055

    Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • Medium 6.1
    CVE-2025-47702

    oEmbed Providers - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-048

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal oEmbed Providers allows Cross-Site Scripting (XSS).This issue affects oEmbed Providers: from 0.0.0 before 2.2.2.

    Drupal oEmbed Providers drupal/oembed_providers Packagist
  • Medium 6.1
    CVE-2025-47703

    COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-049

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.14.

    Drupal COOKiES Consent Management drupal/cookies Packagist
  • Medium 6.1
    CVE-2025-47704

    Klaro Cookie & Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-050

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.5.

    Drupal Klaro Cookie & Consent Management drupal/klaro Packagist
  • Medium 6.1
    CVE-2025-47705

    IFrame Remove Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-051

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal IFrame Remove Filter allows Cross-Site Scripting (XSS).This issue affects IFrame Remove Filter: from 2.0.0 before 2.0.5, from 7.X-1.0 through 7.X-1.5,…

    Drupal IFrame Remove Filter drupal/iframeremove Packagist
  • Medium 4.8
    CVE-2025-47706

    Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052

    Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2025-14927, EUVD-2025-14924, EUVD-2025-14928

  2. #2

    Referenz(en) aufgenommen: EUVD-2025-14926, EUVD-2025-14932, EUVD-2025-14929

  3. #1

    Initiale Fassung

References