Drupal Releases Security Updates

Threat ID:: CC-4041
Threat Severity:: Information only
Published:: 18 February 2022 11:59 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 7.88

Drupal 7

Versions: all prior to 9.3.6, all prior to 9.2.13

Drupal 9

Threat details

Introduction

Drupal has released security updates to address improper input validation and information disclosure vulnerabilities that could affect versions 7, 9.2.x, and 9.3.x. An attacker could exploit these vulnerabilities to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review Drupal Security Advisories SA-CORE-2022-003 and SA-CORE-2022-004 and apply the necessary updates.

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2022-25271

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

Status Published

CVE-2022-25270

The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

Last edited: 18 February 2022 1:25 pm