CVE-2022-25273

At a glance

Severity
HIGH 7.5
EPSS
EPSS 0.57 % · percentile 47 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
drupal
NVD status
Modified

Description

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCISA-ADP
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NNVD · nvd@nist.gov (Primary)
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Weaknesses (CWE)

Advisories

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
Drupal · Coreaffected 9.3 < 9.3.12 ; affected 9.2 < 9.2.18

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD