Skip to content
OpenAdvisories
High WID-SEC-2025-2590 4 CVEs

Drupal Core: Mehrere Schwachstellen

Published Nov 12, 2025 · Updated Nov 18, 2025 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal Core ausnutzen, um einen Denial of Service Angriff durchzuführen, um beliebigen Programmcode auszuführen, um falsche Informationen darzustellen, und um Informationen offenzulegen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 4

  • Medium 5.9
    CVE-2025-13081

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.3
    CVE-2025-13080

    Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 4.3
    CVE-2025-13082

    Drupal core - Moderately critical - Defacement - SA-CORE-2025-007

    User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Low 3.7
    CVE-2025-13083

    Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.…

    Drupal Drupal core drupal/core Web / CMS Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-198027, EUVD-2025-198028, EUVD-2025-198029, EUVD-2025-198031

  2. #1

    Initiale Fassung

References