Vulnerability-Lookup

Vulnerability from drupal

Published

2025-02-05 17:24

Modified

2025-03-31 22:04

Summary

Details

This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth protected resources.

The module does not use Cross Site Request Forgery (CSRF) tokens to protect routes for enabling a client.

This vulnerability is mitigated by the fact that an attacker must know the machine name of the client and deceive another user with this permission.

Credits

Tobias Bähr www.drupal.org/user/183956

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c4.1.3"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/oauth2_client"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c4.1.3"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2025-31684"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/user/183956"
      ],
      "name": "Tobias B\u00e4hr"
    }
  ],
  "details": "This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth protected resources.\n\nThe module does not use Cross Site Request Forgery (CSRF) tokens to protect routes for enabling a client.\n\nThis vulnerability is mitigated by the fact that an attacker must know the machine name of the client and deceive another user with this permission.",
  "id": "DRUPAL-CONTRIB-2025-013",
  "modified": "2025-03-31T22:04:51.000Z",
  "published": "2025-02-05T17:24:48.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2025-013"
    }
  ],
  "schema_version": "1.7.0"
}

CVE-2025-31684 (GCVE-0-2025-31684)

Vulnerability from cvelistv5 – Published: 2025-03-31 21:43 – Updated: 2025-04-29 15:33

Title

OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013

Summary

Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.

Severity ?

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

drupal

References

URL

Tags

https://www.drupal.org/sa-contrib-2025-013

Impacted products

	Vendor	Product	Version
	Drupal	OAuth2 Client	Affected: 0.0.0 , < 4.1.3 (semver)

Credits

Tobias Bähr Shawn Duncan Tobias Bähr cilefen Greg Knaddison

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-31684",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T15:32:54.700505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T15:33:07.247Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/oauth2_client",
          "defaultStatus": "unaffected",
          "product": "OAuth2 Client",
          "repo": "https://git.drupalcode.org/project/oauth2_client",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "4.1.3",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tobias B\u00e4hr"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Shawn Duncan"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tobias B\u00e4hr"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison"
        }
      ],
      "datePublic": "2025-02-05T17:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.\u003cp\u003eThis issue affects OAuth2 Client: from 0.0.0 before 4.1.3.\u003c/p\u003e"
            }
          ],
          "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-31T21:43:06.076Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2025-013"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2025-31684",
    "datePublished": "2025-03-31T21:43:06.076Z",
    "dateReserved": "2025-03-31T21:30:15.359Z",
    "dateUpdated": "2025-04-29T15:33:07.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

Vulnerability from drupal

CVE-2025-31684 (GCVE-0-2025-31684)

Tags

Sightings

Nomenclature