Vulnerability-Lookup

CVE-2025-31684 (GCVE-0-2025-31684)

Vulnerability from cvelistv5 – Published: 2025-03-31 21:43 – Updated: 2025-04-29 15:33

Title

OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013

Summary

Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-29 15:32 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2025-013

Impacted products

1 product

Vendor	Product	Version	CPE status
Drupal	OAuth2 Client	Affected: 0.0.0 , < 4.1.3 (semver)	guessed

Date Public

2025-02-05 17:24

Credits

Tobias Bähr Shawn Duncan Tobias Bähr cilefen Greg Knaddison

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-31684",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T15:32:54.700505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T15:33:07.247Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/oauth2_client",
          "defaultStatus": "unaffected",
          "product": "OAuth2 Client",
          "repo": "https://git.drupalcode.org/project/oauth2_client",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "4.1.3",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tobias B\u00e4hr"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Shawn Duncan"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tobias B\u00e4hr"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison"
        }
      ],
      "datePublic": "2025-02-05T17:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.\u003cp\u003eThis issue affects OAuth2 Client: from 0.0.0 before 4.1.3.\u003c/p\u003e"
            }
          ],
          "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-31T21:43:06.076Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2025-013"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2025-31684",
    "datePublished": "2025-03-31T21:43:06.076Z",
    "dateReserved": "2025-03-31T21:30:15.359Z",
    "dateUpdated": "2025-04-29T15:33:07.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-31684",
      "date": "2026-09-22",
      "epss": "0.00174",
      "percentile": "0.07133"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://www.drupal.org/project/oauth2_client",
                "defaultStatus": "unaffected",
                "product": "OAuth2 Client",
                "repo": "https://git.drupalcode.org/project/oauth2_client",
                "vendor": "Drupal",
                "versions": [
                  {
                    "lessThan": "4.1.3",
                    "status": "affected",
                    "version": "0.0.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "mlhess@drupal.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mskcc:oauth2_client:*:*:*:*:*:drupal:*:*",
                    "matchCriteriaId": "0873936F-AC98-4ED5-BCD9-6BC53D694360",
                    "versionEndExcluding": "4.1.3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3."
          },
          {
            "lang": "es",
            "value": "La vulnerabilidad de Cross-Site Request Forgery (CSRF) en Drupal OAuth2 Client permite Cross-Site Request Forgery. Este problema afecta al cliente OAuth2: desde la versi\u00f3n 0.0.0 hasta la 4.1.3."
          }
        ],
        "id": "CVE-2025-31684",
        "lastModified": "2026-06-17T09:10:46.183",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.2,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-31684",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T15:32:54.700505Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-03-31T22:15:20.993",
        "references": [
          {
            "source": "mlhess@drupal.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.drupal.org/sa-contrib-2025-013"
          }
        ],
        "sourceIdentifier": "mlhess@drupal.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "mlhess@drupal.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T17:46:03+00:00",
      "cve": "CVE-2025-31684",
      "id": "CVE-2025-31684",
      "initial_release_date": "2025-02-05T17:24:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-31684.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "HIGH",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 6.8,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "REQUIRED",
                  "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-31684",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-29T15:32:54.700505Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-04-29T15:32:40.211Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://www.drupal.org/project/oauth2_client",
              "defaultStatus": "unaffected",
              "product": "OAuth2 Client",
              "repo": "https://git.drupalcode.org/project/oauth2_client",
              "vendor": "Drupal",
              "versions": [
                {
                  "lessThan": "4.1.3",
                  "status": "affected",
                  "version": "0.0.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Tobias B\u00e4hr"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Shawn Duncan"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Tobias B\u00e4hr"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "cilefen"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "Greg Knaddison"
            }
          ],
          "datePublic": "2025-02-05T17:24:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.\u003cp\u003eThis issue affects OAuth2 Client: from 0.0.0 before 4.1.3.\u003c/p\u003e"
                }
              ],
              "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-62",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-62 Cross Site Request Forgery"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-352",
                  "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-03-31T21:43:06.076Z",
            "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
            "shortName": "drupal"
          },
          "references": [
            {
              "url": "https://www.drupal.org/sa-contrib-2025-013"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "assignerShortName": "drupal",
        "cveId": "CVE-2025-31684",
        "datePublished": "2025-03-31T21:43:06.076Z",
        "dateReserved": "2025-03-31T21:30:15.359Z",
        "dateUpdated": "2025-04-29T15:33:07.247Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

DRUPAL-CONTRIB-2025-013 (CVE-2025-31684)

Vulnerability from drupal – Published: 2025-02-05 17:24 – Updated: 2025-03-31 22:04 – Source website

Details

This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth protected resources.

The module does not use Cross Site Request Forgery (CSRF) tokens to protect routes for enabling a client.

This vulnerability is mitigated by the fact that an attacker must know the machine name of the client and deceive another user with this permission.

Credits

Tobias Bähr www.drupal.org/user/183956

References

URL

Type

https://www.drupal.org/sa-contrib-2025-013

WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c4.1.3"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/oauth2_client"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c4.1.3"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2025-31684"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/user/183956"
      ],
      "name": "Tobias B\u00e4hr"
    }
  ],
  "details": "This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth protected resources.\n\nThe module does not use Cross Site Request Forgery (CSRF) tokens to protect routes for enabling a client.\n\nThis vulnerability is mitigated by the fact that an attacker must know the machine name of the client and deceive another user with this permission.",
  "id": "DRUPAL-CONTRIB-2025-013",
  "modified": "2025-03-31T22:04:51.000Z",
  "published": "2025-02-05T17:24:48.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2025-013"
    }
  ],
  "schema_version": "1.7.0"
}

FKIE_CVE-2025-31684

Vulnerability from fkie_nvd - Published: 2025-03-31 22:15 - Updated: 2026-06-17 09:10

Severity

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Summary

Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.

References

	URL	Tags
	mlhess@drupal.org	https://www.drupal.org/sa-contrib-2025-013	Third Party Advisory

Impacted products

	Vendor	Product	Version
	mskcc	oauth2_client	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://www.drupal.org/project/oauth2_client",
          "defaultStatus": "unaffected",
          "product": "OAuth2 Client",
          "repo": "https://git.drupalcode.org/project/oauth2_client",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "4.1.3",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mskcc:oauth2_client:*:*:*:*:*:drupal:*:*",
              "matchCriteriaId": "0873936F-AC98-4ED5-BCD9-6BC53D694360",
              "versionEndExcluding": "4.1.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de Cross-Site Request Forgery (CSRF) en Drupal OAuth2 Client permite Cross-Site Request Forgery. Este problema afecta al cliente OAuth2: desde la versi\u00f3n 0.0.0 hasta la 4.1.3."
    }
  ],
  "id": "CVE-2025-31684",
  "lastModified": "2026-06-17T09:10:46.183",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-31684",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-29T15:32:54.700505Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-03-31T22:15:20.993",
  "references": [
    {
      "source": "mlhess@drupal.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.drupal.org/sa-contrib-2025-013"
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "mlhess@drupal.org",
      "type": "Secondary"
    }
  ]
}

GHSA-6CHF-HHQF-749C

Vulnerability from github – Published: 2025-04-01 00:30 – Updated: 2025-04-29 20:20

Summary

Drupal OAuth2 Client Cross-Site Request Forgery (CSRF)

Details

Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery. This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

2.4 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/oauth2_client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-31684"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-02T17:10:48Z",
    "nvd_published_at": "2025-03-31T22:15:20Z",
    "severity": "LOW"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery. This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.",
  "id": "GHSA-6chf-hhqf-749c",
  "modified": "2025-04-29T20:20:34Z",
  "published": "2025-04-01T00:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31684"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.drupalcode.org/project/oauth2_client"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2025-013"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Drupal OAuth2 Client Cross-Site Request Forgery (CSRF)"
}

WID-SEC-W-2025-0278

Vulnerability from csaf_certbund - Published: 2025-02-05 23:00 - Updated: 2025-04-01 22:00

Summary

Drupal OAuth2 Client: Schwachstelle ermöglicht Manipulation

Severity

Niedrig

Scope

1 vulnerability in this advisory, including CVE-2025-31684.

CVE-2025-31684

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-31684 (GCVE-0-2025-31684)

DRUPAL-CONTRIB-2025-013 (CVE-2025-31684)

FKIE_CVE-2025-31684

GHSA-6CHF-HHQF-749C

WID-SEC-W-2025-0278

Tags

Sightings

Nomenclature

Related by attack behaviour