Fehlerhafte Eingabevalidierung in Drupal Core

The vulnerability lies in the form API's handling of input validation. While affected forms are not widespread, successful exploitation could allow an attacker to modify critical or sensitive data within the Drupal site. This could involve altering user roles, permissions, or other configuration settings. The potential impact depends heavily on the specific modules and forms involved, but the ability to manipulate data directly poses a significant risk. A successful attack could lead to unauthorized access, data breaches, or even complete site compromise.

1. Reserviert2022-02-16
2. Veröffentlicht2023-04-26
3. Geändert2025-02-03
4. EPSS aktualisiert2026-04-02

The primary mitigation is to upgrade Drupal Core to version 9.2.18 or later. Before upgrading, it's crucial to review all contributed and custom modules for potential vulnerabilities and ensure compatibility with the new Drupal Core version. Consider creating a backup of the site before initiating the upgrade process. If an immediate upgrade is not possible, implement strict input validation on all custom forms and review contributed modules for known vulnerabilities. WAF rules can be configured to filter suspicious input patterns, but this is not a substitute for patching.