CVE-2022-25271

Vulnerability

Drupal core's form API contains an improper input validation vulnerability affecting certain contributed or custom modules' forms. This allows an attacker to inject disallowed values or overwrite data. The vulnerability affects Drupal core versions prior to the fix. [1]

Exploitation

An attacker can exploit this vulnerability by submitting crafted input to a vulnerable form. No authentication is required if the form is publicly accessible. The attack complexity is low, but the vulnerable forms are uncommon. [1]

Impact

Successful exploitation could allow an attacker to alter critical or sensitive data. The scope of impact depends on the module's data, potentially leading to data integrity compromise or unauthorized overwriting of data. [1]

Mitigation

The Drupal project has released security updates to address this vulnerability. Users should update to the latest Drupal core version. For specific version details, refer to the Drupal security advisory. [1]