Skip to content
OpenAdvisories
Medium WID-SEC-2025-1065 6 CVEs

Drupal Extensions: Mehrere Schwachstellen

Published May 14, 2025 · Updated May 21, 2025 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen und andere nicht spezifizierte Angriffe durchzuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 6

  • High 7.5
    CVE-2025-4416

    Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track: from 0.0.0 before 3.1.11, from 4.0.0 before 4.0.2.

    Drupal Events Log Track drupal/events_log_track Packagist
  • Medium 4.8
    CVE-2025-4415

    Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.

    Drupal Piwik PRO drupal/piwik_pro Packagist
  • Medium 4.8
    CVE-2025-48010

    One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.

    Drupal One Time Password drupal/one_time_password Packagist
  • Medium 4.8
    CVE-2025-48011

    One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.

    Drupal One Time Password drupal/one_time_password Packagist
  • Medium 4.8
    CVE-2025-48012

    One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063

    Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0.

    Drupal One Time Password drupal/one_time_password Packagist
  • Low 3.1
    CVE-2025-48009

    Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060

    Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12.

    Drupal Single Content Sync drupal/single_content_sync Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-16011, EUVD-2025-16016, EUVD-2025-16015, EUVD-2025-16014, EUVD-2025-16013, EUVD-2025-16012

  2. #1

    Initiale Fassung

References