CVE-2025-10929: Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111
Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables. This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.
Other sources
Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/reverse_proxy_headerto a version that resolves this vulnerability.Fixed in 1.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10929?
CVE-2025-10929 has a moderate severity level due to improper validation of user-controlled variables.
How do I fix CVE-2025-10929?
To fix CVE-2025-10929, update Drupal Reverse Proxy Header to version 1.1.2 or later.
What impact can CVE-2025-10929 have on my Drupal site?
CVE-2025-10929 can lead to manipulation of user-controlled variables, potentially affecting site integrity and security.
Is CVE-2025-10929 specific to certain versions of Drupal?
Yes, CVE-2025-10929 affects Drupal Reverse Proxy Header versions before 1.1.2.
Who is affected by CVE-2025-10929?
Users of Drupal Reverse Proxy Header versions from 0.0.0 up to 1.1.2 are affected by CVE-2025-10929.