CVE-2022-25276

At a glance

Severity: MEDIUM 6.1
EPSS: EPSS 0.53 % · percentile 44 (2026-10-28)
State: PUBLISHED
Published: 2023-04-26
Updated: 2025-02-03
Assigner: drupal
NVD status: Modified

Description

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	CISA-ADP
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	NVD · nvd@nist.gov (Primary)
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Weaknesses (CWE)

CWE-79

Advisories

DRUPAL-CORE-2022-015 — The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Un
GHSA-4wfq-jc9h-vpcx — Lack of domain validation in Druple core

European references

ENISA EUVD · EUVD-2023-1196
GCVE · GCVE-0-2022-25276

CERT-FR advisories

CERTFR-2022-AVI-667 — Multiples vulnérabilités dans Drupal · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 9.3.0 < 9.3.19
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 9.4.0 < 9.4.3

Affected products

Product	Versions
Drupal · Core	affected 9.4 < 9.4.3 ; affected 9.3 < 9.3.19

References

https://www.drupal.org/sa-core-2022-015

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD