Drupal Core anfällig für erzwungenes Durchsuchen

The Forceful Browsing vulnerability (CVE-2025-31673) allows an attacker to potentially access sensitive data or perform unauthorized actions by directly accessing URLs that should be protected. This could include viewing administrative pages, accessing user data, or even modifying content, depending on the specific resources exposed. The impact is particularly severe if the attacker can gain access to privileged information or manipulate critical website functionality. This vulnerability is similar in nature to other authorization bypass flaws, where attackers can circumvent access controls by crafting specific requests.

1. Reserviert2025-03-31
2. Veröffentlicht2025-04-01
3. Geändert2025-12-10
4. EPSS aktualisiert2026-03-23

The recommended mitigation for CVE-2025-31673 is to upgrade Drupal Core to version 10.3.13, 10.4.3, or 11.0.12, depending on the version currently in use. If upgrading is not immediately possible, review and restrict access to sensitive resources using Drupal's access control mechanisms. Implement strict URL validation and sanitization to prevent attackers from manipulating URLs to bypass access controls. After upgrading, verify the fix by attempting to access restricted resources directly through crafted URLs and confirming that access is denied.