Medium WID-SEC-2025-1918 6 CVEs

Drupal Extensions: Mehrere Schwachstellen

Published Aug 27, 2025 · Updated Oct 12, 2025 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Extensions ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 6

High 8.8

CVE-2025-8093

Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.

Drupal Authenticator Login drupal/alogin Packagist

Oct 10, 2025
Medium 6.5

CVE-2025-9549

Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099

Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

Drupal Facets drupal/facets Packagist

Oct 10, 2025
Medium 6.5

CVE-2025-9551

Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.

Drupal Protected Pages drupal/protected_pages Packagist

Oct 10, 2025
Medium 5.3

CVE-2025-9552

Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102

Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.*.

Drupal Synchronize composer.json With Contrib Modules drupal/sync_composer_with_contrib Packagist

Oct 10, 2025
Medium 5.3

CVE-2025-9553

API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103

Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*.

Drupal API Key manager drupal/api_key_manager Packagist

Oct 10, 2025
Medium 5.3

CVE-2025-9554

Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104

Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*.

Drupal Owl Carousel 2 drupal/owlcarousel2 Packagist

Oct 10, 2025

Revision history

2025-10-12 #2
Referenz(en) aufgenommen: EUVD-2025-33789, EUVD-2025-33791, EUVD-2025-33792, EUVD-2025-33785, EUVD-2025-33788, EUVD-2025-33787
2025-08-27 #1
Initiale Fassung

References

Drupal Security Advsiory SA-CONTRIB-2025-098 vom 2025-08-27
https://www.drupal.org/sa-contrib-2025-098
Drupal Security Advsiory SA-CONTRIB-2025-099 vom 2025-08-27
https://www.drupal.org/sa-contrib-2025-099
Drupal Security Advsiory SA-CONTRIB-2025-100 vom 2025-08-27
https://www.drupal.org/sa-contrib-2025-100
Drupal Security Advsiory SA-CONTRIB-2025-101 vom 2025-08-27
https://www.drupal.org/sa-contrib-2025-101
Drupal Security Advsiory SA-CONTRIB-2025-102 vom 2025-08-27
https://www.drupal.org/sa-contrib-2025-102
Drupal Security Advsiory SA-CONTRIB-2025-103 vom 2025-08-27
https://www.drupal.org/sa-contrib-2025-103
Drupal Security Advsiory SA-CONTRIB-2025-104 vom 2025-08-27
https://www.drupal.org/sa-contrib-2025-104