CVE-2022-25276

The vulnerability occurs in Drupal core's Media oEmbed iframe route, which does not properly validate the iframe domain setting [2][3]. This allows oEmbed embeds to be displayed in the context of the primary domain, bypassing same-origin restrictions.

An attacker can exploit this by crafting a malicious oEmbed URL or embedding content from an untrusted domain. Since the iframe domain is not validated, the embedded content is rendered within the security context of the primary domain, enabling cross-site scripting (XSS) or cookie leakage [2][3].

Successful exploitation could lead to XSS attacks, theft of authentication cookies, or other vulnerabilities that rely on executing script in the victim's session [2][3].

The issue is fixed in Drupal 9.4.3 and 9.3.19 [3]. Drupal 7 is not affected as it does not include the Media module. Drupal 8 and earlier versions have reached end-of-life and are not patched [3].