CVE-2022-25278: Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013
Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013
Other sources
Drupal core form API evaluates form element access incorrectly. This can lead to a user being able to alter data they should not have access to.
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 9.4.3 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 9.3.19
Event History
Frequently Asked Questions
What is CVE-2022-25278?
CVE-2022-25278 is a vulnerability in Drupal core that allows a user to alter data they should not have access to.
What is the severity of CVE-2022-25278?
The severity of CVE-2022-25278 is classified as moderately critical.
Which versions of Drupal core are affected by CVE-2022-25278?
Drupal core versions 8.0.0 to 9.3.19 and 9.4.0 to 9.4.3 are affected by CVE-2022-25278.
Are forms provided by Drupal core vulnerable to CVE-2022-25278?
No, forms provided by Drupal core are not known to be vulnerable to CVE-2022-25278.
Where can I find more information about CVE-2022-25278?
You can find more information about CVE-2022-25278 on the Drupal website at https://www.drupal.org/sa-core-2022-013.