What is CVE-2022-25273?

CVE-2022-25273 is a high-severity vulnerability in Drupal Core, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2023-04-26.

How severe is CVE-2022-25273?

High severity. CVSS v3 base score is 7.5 out of 10.

Improper input validation in Drupal Core

CVE-2022-25273

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are un…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.006 (43.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Drupal Core — versions 9.3, 9.2
Drupal

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

mlhess@drupal.org (Vendor Advisory)

Frequently asked questions

What is CVE-2022-25273?: CVE-2022-25273 is a high-severity vulnerability in Drupal Core, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2023-04-26.
How severe is CVE-2022-25273?: High severity. CVSS v3 base score is 7.5 out of 10.