High WID-SEC-2025-1119 6 CVEs

Drupal Produkte: Mehrere Schwachstellen

Published May 21, 2025 · Updated May 21, 2025 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting durchzuführen oder einen Denial of Service auszuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 6

High 8.8

CVE-2025-48445

Commerce Eurobank (Redirect) - Moderately critical - Access bypass - SA-CONTRIB-2025-066

Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.

Drupal Commerce Eurobank (Redirect) drupal/commerce_eurobank_redirect Packagist

Jun 11, 2025
High 8.8

CVE-2025-48446

Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067

Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.

Drupal Commerce Alphabank Redirect drupal/commerce_alphabank_redirect Packagist

Jun 11, 2025
High 7.1

CVE-2025-48447

Lightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site Scripting (XSS).This issue affects Lightgallery: from 0.0.0 before 1.6.0.

Drupal Lightgallery drupal/lightgallery Packagist

Jun 11, 2025
Medium 6.5

CVE-2025-48448

Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5.

Drupal Admin Audit Trail drupal/admin_audit_trail Packagist

Jun 11, 2025
Medium 5.3

CVE-2025-48013

Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

Drupal Quick Node Block drupal/quick_node_block Packagist

Jun 11, 2025
Medium 5.3

CVE-2025-48444

Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

Drupal Quick Node Block drupal/quick_node_block Packagist

Jun 11, 2025

Revision history

2025-05-21 #1
Initiale Fassung

References

Drupal Security Advisory vom 2025-05-21
https://www.drupal.org/sa-contrib-2025-064
Drupal Security Advisory vom 2025-05-21
https://www.drupal.org/sa-contrib-2025-065
Drupal Security Advisory vom 2025-05-21
https://www.drupal.org/sa-contrib-2025-066
Drupal Security Advisory vom 2025-05-21
https://www.drupal.org/sa-contrib-2025-067
Drupal Security Advisory vom 2025-05-21
https://www.drupal.org/sa-contrib-2025-068
Drupal Security Advisory vom 2025-05-21
https://www.drupal.org/sa-contrib-2025-069