CVE-2022-25275
2 advisories.
Packagist/drupal/core CVE-2022-25275: unknown, EPSS 0.67%
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system.
Action: Upgrade drupal/core to 9.3.19 or later.
composer require drupal/core:9.3.19composer require drupal/core:9.4.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 9.3.19 | - |
| 9.4.0 | 9.4.3 | - |
Fixed versions
| 9.3.19 | 9.4.3 |
Sources
CVE-2022-25275 · published · modified · JSON
Packagist/drupal/core CVE-2022-25275: high 7.5, EPSS 0.67%
Drupal core Information Disclosure vulnerability
Action: Upgrade drupal/core to 7.91 or later.
composer require drupal/core:7.91composer require drupal/core:9.3.19composer require drupal/core:9.4.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.0.0 | 7.91 | - |
| 8.0.0 | 9.3.19 | - |
| 9.4.0 | 9.4.3 | - |
Fixed versions
| 7.91 | 9.3.19 | 9.4.3 |
Sources
- osv: GHSA-xh3v-6f9j-wxw3
- https://nvd.nist.gov/vuln/detail/CVE-2022-25275
- https://github.com/drupal/core/commit/2d5f47fc8a166115f56c2330a81e83abe22445cf
- https://github.com/drupal/core/commit/e2fbf63700819cb470a1be425798f1a3f2020116
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25275.yaml
- https://github.com/drupal/core
- https://www.drupal.org/sa-core-2022-012
CVE-2022-25275 · published · modified · JSON