Back to search
CVE-2022-25278
Published: Apr 26, 2023
Modified: Feb 3, 2025
PUBLISHED
Description
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
| Vendor | Product | Versions |
|---|---|---|
Drupal | Core | affected 9.4 - < 9.4.3affected 9.3 - < 9.3.19 |
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now