What is CVE-2022-25274?

CVE-2022-25274 is a medium-severity vulnerability in Drupal Core, classified under Incorrect Authorization. CVSS score: 5.4/10. Published 2023-04-26.

How severe is CVE-2022-25274?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Auth bypass in Drupal Core

CVE-2022-25274

Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of cont…

Vulnerability class: Broken Access Control

EPSS: 0.004 (34.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Drupal Core — versions 9.3
Drupal

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

mlhess@drupal.org (Vendor Advisory)

Frequently asked questions

What is CVE-2022-25274?: CVE-2022-25274 is a medium-severity vulnerability in Drupal Core, classified under Incorrect Authorization. CVSS score: 5.4/10. Published 2023-04-26.
How severe is CVE-2022-25274?: Medium severity. CVSS v3 base score is 5.4 out of 10.