Vulnerability advisory
CVE-2022-25274
Also known as BIT-drupal-2022-25274DRUPAL-CORE-2022-009GHSA-7jr4-hgqx-vwgq
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/drupal/drupal ↗ | |
| 698ee686c23de8c97d7e0601cf745b220d54f4e1 to before aa750f98c476ab867f6c6a14bbafcd2e98814512 | aa750f98c476ab867f6c6a14bbafcd2e98814512 |
Also listed as affected (6)
| |
Description
Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content. This vulnerability only affects sites using Drupal's revision system.