CVE-2022-25276
2 advisories.
Packagist/drupal/core CVE-2022-25276: unknown
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could le
Action: Upgrade drupal/core to 9.3.19 or later.
composer require drupal/core:9.3.19composer require drupal/core:9.4.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 9.3.19 | - |
| 9.4.0 | 9.4.3 | - |
Fixed versions
| 9.3.19 | 9.4.3 |
Sources
CVE-2022-25276 · published · modified · JSON
Packagist/drupal/core CVE-2022-25276: medium 6.1
Lack of domain validation in Druple core
Action: Upgrade drupal/core to 9.3.19 or later.
composer require drupal/core:9.3.19composer require drupal/core:9.4.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 9.3.19 | - |
| 9.4.0 | 9.4.3 | - |
Fixed versions
| 9.3.19 | 9.4.3 |
Sources
- osv: GHSA-4wfq-jc9h-vpcx
- https://nvd.nist.gov/vuln/detail/CVE-2022-25276
- https://github.com/drupal/core
- https://www.drupal.org/sa-core-2022-015
CVE-2022-25276 · published · modified · JSON