Moderate severityNVD Advisory· Published Apr 26, 2023· Updated Feb 3, 2025

CVE-2022-25278

Description

Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
drupal/corePackagist	>= 8.0.0, < 9.3.19	9.3.19
drupal/corePackagist	>= 9.4.0, < 9.4.3	9.4.3

Affected products

osv-coords2 versions
pkg:bitnami/drupal pkg:composer/drupal/core
>= 8.0.0, < 9.3.19+ 1 more
- (no CPE)range: >= 8.0.0, < 9.3.19
- (no CPE)range: >= 8.0.0, < 9.3.19
Drupal/Corev5
Range: 9.4

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-cfh2-7f6h-3m85ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-25278ghsaADVISORY
github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25278.yamlghsaWEB
www.drupal.org/sa-core-2022-013ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000