CVE-2025-13080

Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005

Description

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

Scores

Faiblesses (CWE)

• CWE-754

Avis

• DRUPAL-CORE-2025-005 — Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden.
• GHSA-83v7-c2cf-p9c2 — Drupal core allows Forceful Browsing

Références européennes

• ENISA EUVD · EUVD-2025-198031
• GCVE · GCVE-0-2025-13080

Avis du CERT-FR

• CERTFR-2025-AVI-1003 — Multiples vulnérabilités dans Drupal · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 8.0.0 < 10.4.9
• cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 10.5.0 < 10.5.6
• cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.1.9
• cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 11.2.0 < 11.2.8

Produits affectés

Références

• https://www.drupal.org/sa-core-2025-005

Sources