CVE-2022-25273

En bref

Sévérité
HIGH 7.5
EPSS
EPSS 0.57 % · centile 47 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
drupal
Statut NVD
Modified

Description

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCISA-ADP
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NNVD · nvd@nist.gov (Primary)
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Faiblesses (CWE)

Avis

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Drupal · Coreaffected 9.3 < 9.3.12 ; affected 9.2 < 9.2.18

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD