ड्रुपल कोर सूचना प्रकटीकरण भेद्यता (Drupal core Information Disclosure vulnerability)

CVE-2022-25275 in Drupal Core affects the Image module when generating derivative images using the image style system. The issue lies in the fact that, in certain circumstances, the module does not correctly check access permissions to image files that are not stored in the standard public files directory. Specifically, access checks for non-public files are only performed if they are stored in the 'private' file system. However, some contributed modules provide additional file systems or schemes, which can allow unauthorized access to these files. This could allow an attacker to access sensitive files that should not be publicly accessible, compromising the confidentiality of data stored on the Drupal site. The vulnerability's severity is rated as 7.5 on the CVSS scale, indicating a moderately high risk.

1. आरक्षित2022-02-16
2. प्रकाशित2023-04-26
3. संशोधित2025-02-03
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2022-25275 is to update Drupal Core to version 7.91 or higher. This update corrects the permission checking flaw in the Image module. Additionally, it's important to review and update any contributed modules that utilize custom file systems or alternative schemes for image file handling. Ensure these modules correctly implement file access checks, regardless of where the files are stored. Finally, it is recommended to configure the Drupal site to use the 'private' file system for storing sensitive files whenever possible, to further reinforce security.

अंतिम अपडेट

7.x-1.x-dev132 महीने पहले