Drupal Core 9.3.x Security Bypass (9.3.0 - 9.3.5) - Vulnerabilities

Description

Drupal Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to inject disallowed values into forms or overwrite data. Drupal Core versions 9.3.x ranging from 9.3.0 and up to and including 9.3.5 are vulnerable.

Remediation

Update to Drupal Core version 9.3.6 or latest

References

https://www.drupal.org/sa-core-2022-003

Related Vulnerabilities

WordPress Plugin Photoracer Multiple Cross-Site Scripting and SQL Injection Vulnerabilities (1.0)

WordPress Plugin Jetpack-WP Security, Backup, Speed, & Growth Cross-Site Scripting (3.9.1)

Magento Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-7889)

WordPress Improper Input Validation Vulnerability (CVE-2020-28037)

WordPress Plugin Twitter Button by BestWebSoft Cross-Site Request Forgery (2.14)

Severity

High

Classification

CVE-2022-25271 CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Drupal Core 9.3.x Security Bypass (9.3.0 - 9.3.5)