CVE-2022-25274
First published: Wed Apr 26 2023(Updated: )
Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content. This vulnerability only affects sites using Drupal's revision system.
Credit: mlhess@drupal.org mlhess@drupal.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Drupal Drupal | >=9.3.0<9.3.12 | |
| composer/drupal/core | >=9.3.0<9.3.12 | 9.3.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Drupal vulnerability?
The vulnerability ID for this Drupal vulnerability is CVE-2022-25274.
What is the severity rating of CVE-2022-25274?
CVE-2022-25274 has a severity rating of medium (5.4).
What is the affected software version range for this vulnerability?
The affected software version range for CVE-2022-25274 is Drupal 9.3.0 to 9.3.12.
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The Common Weakness Enumeration (CWE) ID for CVE-2022-25274 is CWE-863.
How can I fix CVE-2022-25274?
To fix CVE-2022-25274, it is recommended to upgrade your Drupal installation to version 9.3.13 or later.
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-7jr4-hgqx-vwgq
- alias/CVE-2022-25274
- collector/nvd-cve
- collector/github-advisory
- vendor/drupal
- canonical/drupal drupal
- version/drupal drupal/9.3.0
- package-manager/composer