Skip to content
OpenAdvisories
High · 7.5 CVE-2022-25271 BIT-drupal-2022-25271DRUPAL-CORE-2022-003EUVD-2022-0984GHSA-fmfv-x8mp-5767

Improper input validation in Drupal core

Published Feb 16, 2022 · Updated Aug 3, 2024 · Assigned by drupal

Vendor: Drupal Product: Core Package: drupal/core Package: drupal7 Package: drupal7 Ecosystem: Alpine Ecosystem: Packagist Ecosystem: Ubuntu

Description

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

Affected products

VendorProductAffectedFixed
Drupal Core 9.3.x – < 9.3.6, 9.2.x – < 9.2.13, 7.x – < 7.88 9.3.6

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 9 drupal7 7.52-2+deb9u18 DLA-2925-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS drupal7 No fix yet —
Ubuntu Pro 14.04 LTS drupal7 No fix yet —

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.20 drupal7 7.89-r0 —
Alpine v3.19 drupal7 7.89-r0 —
Alpine v3.18 drupal7 7.89-r0 —
Alpine v3.17 drupal7 7.89-r0 —
Alpine v3.16 drupal7 7.89-r0 —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.15 drupal7 7.89-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/core >= 8.0.0, < 9.2.13 · >= 9.3.0, < 9.3.6 9.2.13, 9.3.6 DRUPAL-CORE-2022-003
Packagist drupal/core >= 9.3.0, < 9.3.6 9.3.6 GHSA-fmfv-x8mp-5767
Packagist drupal/core >= 8.0.0, < 9.2.13 9.2.13 GHSA-fmfv-x8mp-5767
Packagist drupal/core >= 7.0.0, < 7.88 7.88 GHSA-fmfv-x8mp-5767

Advisories 1

References