Vulnerability-Lookup

Vulnerability from drupal

Published

2025-07-09 16:37

Modified

2025-11-22 09:22

Summary

Details

This module enables users to login by email address with the minimal configurations.

The module included some protection against brute force attacks on the login form, however they were incomplete. An attacker could bypass the brute force protection allowing them to potentially gain access to an account.

Credits

Ryugo Kinoshita (dc-kinoshita) www.drupal.org/u/dc-kinoshita

References

URL

Type

https://www.drupal.org/sa-contrib-2025-088

WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c3.2.0 || \u003e=4.0.0 \u003c4.2.0"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/mail_login"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c3.2.0"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=4.0.0 \u003c4.2.0"
          },
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2025-7393"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/dc-kinoshita"
      ],
      "name": "Ryugo Kinoshita (dc-kinoshita)"
    }
  ],
  "details": "This module enables users to login by email address with the minimal configurations.\n\nThe module included some protection against brute force attacks on the login form, however they were incomplete. An attacker could bypass the brute force protection allowing them to potentially gain access to an account.",
  "id": "DRUPAL-CONTRIB-2025-088",
  "modified": "2025-11-22T09:22:47.000Z",
  "published": "2025-07-09T16:37:40.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2025-088"
    }
  ],
  "schema_version": "1.7.0"
}

CVE-2025-7393 (GCVE-0-2025-7393)

Vulnerability from cvelistv5 – Published: 2025-07-21 16:35 – Updated: 2025-07-22 14:07

Title

Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088

Summary

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-307 - Improper Restriction of Excessive Authentication Attempts

Assigner

drupal

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2025-088

Impacted products

1 product

Vendor	Product	Version
Drupal	Mail Login	Affected: 3.0.0 , < 3.2.0 (semver) Affected: 4.0.0 , < 4.2.0 (semver)

Date Public

2025-07-09 16:37

Credits

Ryugo Kinoshita (dc-kinoshita) Damien McKenna (damienmckenna) Mohammad AlQanneh (mqanneh) Greg Knaddison (greggles)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-7393",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-22T14:06:55.624230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-22T14:07:11.356Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/mail_login",
          "defaultStatus": "unaffected",
          "product": "Mail Login",
          "repo": "https://git.drupalcode.org/project/mail_login",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "3.2.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ryugo Kinoshita (dc-kinoshita)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Damien McKenna (damienmckenna)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mohammad AlQanneh (mqanneh)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        }
      ],
      "datePublic": "2025-07-09T16:37:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.\u003cp\u003eThis issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.\u003c/p\u003e"
            }
          ],
          "value": "Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-112",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-112 Brute Force"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-21T16:35:45.527Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2025-088"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2025-7393",
    "datePublished": "2025-07-21T16:35:45.527Z",
    "dateReserved": "2025-07-09T16:03:35.868Z",
    "dateUpdated": "2025-07-22T14:07:11.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

Vulnerability from drupal

CVE-2025-7393 (GCVE-0-2025-7393)

Tags

Sightings

Nomenclature