CVE-2022-25276

En bref

Sévérité: MEDIUM 6.1
EPSS: EPSS 0.53 % · centile 44 (2026-10-27)
État: PUBLISHED
Publiée: 2023-04-26
Mise à jour: 2025-02-03
Attribuée par: drupal
Statut NVD: Modified

Description

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	CISA-ADP
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	NVD · nvd@nist.gov (Primary)
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Faiblesses (CWE)

CWE-79

Avis

DRUPAL-CORE-2022-015 — The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Un
GHSA-4wfq-jc9h-vpcx — Lack of domain validation in Druple core

Références européennes

ENISA EUVD · EUVD-2023-1196
GCVE · GCVE-0-2022-25276

Avis du CERT-FR

CERTFR-2022-AVI-667 — Multiples vulnérabilités dans Drupal · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 9.3.0 < 9.3.19
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 9.4.0 < 9.4.3

Produits affectés

Produit	Versions
Drupal · Core	affected 9.4 < 9.4.3 ; affected 9.3 < 9.3.19

Références

https://www.drupal.org/sa-core-2022-015

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD