tocsin

Packagist/drupal/core CVE-2022-25273: unknown, EPSS 0.57%

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values o

Action: Upgrade drupal/core to 9.2.18 or later.

composer require drupal/core:9.2.18
composer require drupal/core:9.3.12

Affected

introducedfixedlast affected
8.0.09.2.18-
9.3.09.3.12-

Fixed versions

9.2.189.3.12

Sources

CVE-2022-25273 · published · modified · JSON