DRUPAL-CORE-2025-007
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2025-13082
- Alias
- BIT-drupal-2025-13082, GHSA-h89p-5896-f4q8
Description
By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement. The defacement is not stored and is only present when the URL has been crafted for that purpose. Only the defacement is present, so no other site content (such as branding) is rendered.
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · drupal/core | introduced 8.0.0, fixed 10.4.9 ; introduced 10.5.0, fixed 10.5.6 ; introduced 11.0.0, fixed 11.1.9 ; introduced 11.2.0, fixed 11.2.8 |
Références
Sources
| Source | Licence |
|---|---|
| OSV.dev | See osv.dev/data for this database's licence |