Drupal Core
19 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2023-5256 | 10.1 – 10.1.4 ; 10.0 – 10.0.11 ; 9.5 – 9.5.11 | Drupal core - Critical - Cache poisoning - SA-CORE-2023-006 | HIGH 7.5 | 0.9 % | ||
| CVE-2023-31250 | 7.0 – < 7.96 ; 10.0 – < 10.0.8 ; 9.5 – < 9.5.8 ; … | Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005 | MEDIUM 6.5 | 0.5 % | ||
| CVE-2022-25278 | 9.4 – < 9.4.3 ; 9.3 – < 9.3.19 | Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter | MEDIUM 6.5 | 0.6 % | ||
| CVE-2022-25277 | 9.4 – < 9.4.3 ; 9.3 – < 9.3.19 | Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots fro | HIGH 7.2 | 1.4 % | ||
| CVE-2022-25276 | 9.4 – < 9.4.3 ; 9.3 – < 9.3.19 | The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of th | MEDIUM 6.1 | 0.5 % | ||
| CVE-2022-25275 | 9.4 – < 9.4.3 ; 9.3 – < 9.3.19 ; 7 – < 7.91 | In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when g | HIGH 7.5 | 0.7 % | ||
| CVE-2022-25274 | 9.3 – < 9.3.12 | Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permi | MEDIUM 5.4 | 0.4 % | ||
| CVE-2022-25273 | 9.3 – < 9.3.12 ; 9.2 – < 9.2.18 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation | HIGH 7.5 | 0.6 % | ||
| CVE-2022-25270 | 9.3.x – < 9.3.6 ; 9.2.x – < 9.2.13 | The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place edit | MEDIUM 6.5 | 0.8 % | ||
| CVE-2022-25271 | 9.3.x – < 9.3.6 ; 9.2.x – < 9.2.13 ; 7.x – < 7.88 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation | HIGH 7.5 | 1.3 % | ||
| CVE-2020-13677 | 9.2.x – < 9.2.6 ; 9.1.x – < 9.1.13 ; 8.9.x – < 8.9.19 | Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintend | HIGH 7.5 | 1.2 % | ||
| CVE-2020-13676 | 9.2 – < 9.2.6 ; 9.1 – < 9.1.13 ; 8.9 – < 8.9.19 | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. | MEDIUM 6.5 | 0.8 % | ||
| CVE-2020-13670 | 8.8.x – < 8.8.10 ; 8.9.x – < 8.9.6 ; 9.0.x – < 9.0.6 | Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent pri | HIGH 7.5 | 1.1 % | ||
| CVE-2020-13674 | 9.2 – < 9.2.6 ; 9.1 – < 9.1.13 ; 8.9 – < 8.9.19 | The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and | MEDIUM 6.5 | 0.5 % | ||
| CVE-2020-13675 | 9.2.x – < 9.2.6 ; 9.1.x – < 9.1.13 ; 8.9.x – < 8.9.19 | Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, wh | CRITICAL 9.8 | 1.4 % | ||
| CVE-2020-13672 | 9.1.x – < 9.1.7 ; 9.0.x – < 9.0.12 ; 8.9.x – < 8.9.14 ; … | Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circu | MEDIUM 6.1 | 0.7 % | ||
| CVE-2020-13669 | 8.8.x – < 8.8.10 ; 8.9.x – < 8.9.6 ; 9.0.x – < 9.0.6 | Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x ver | MEDIUM 6.1 | 0.7 % | ||
| CVE-2020-13668 | 8.8.x – < 8.8.10 ; 8.9.x – < 8.9.6 ; 9.0.x – < 9.0.6 | Access bypass in Drupal Core 8/9 | MEDIUM 6.1 | 0.8 % | ||
| CVE-2018-7602 | unspecified – < 7.59 ; unspecified – < 8.5.3 ; unspecified – < 8.4.8 | Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 | CRITICAL 9.8 | 99 % | KEV |