CVE-2022-25278

Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.

Database specific

{
    "cna_assigner": "drupal",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25278.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "9.4"
                },
                {
                    "fixed": "9.4.3"
                },
                {
                    "introduced": "9.3"
                },
                {
                    "fixed": "9.3.19"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/drupal/drupal

Affected ranges

Type

GIT

Repo

https://github.com/drupal/drupal

Events

Introduced

35c2f3ca5c935f3d8bde15932a712677c9bbd50f

Fixed

32680a4aef16035fd6c90014761dcad8de628120

Introduced

970c1b5cfa946f683de326a3f252b5371a42186a

Fixed

bf401c8d5c5a88d442ac7e95a9eb059d123a771c

Database specific

Show details

{
    "cpe": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "9.3.19"
        },
        {
            "introduced": "9.4.0"
        },
        {
            "fixed": "9.4.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

8.*

8.0.0

8.1.0-beta1

9.*

9.0.0-alpha1

9.0.0-alpha2

9.3.0

9.3.0-alpha1

9.3.0-beta1

9.3.0-beta2

9.3.0-beta3

9.3.0-rc1

9.3.10

9.3.11

9.3.13

9.3.15

9.3.17

9.3.18

9.3.2

9.3.4

9.3.7

9.4.0

9.4.1

9.4.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25278.json"