Drupal — система управления контентом с открытым исходным кодом. На Drupal работает более миллиона сайтов — от личных блогов до сайтов компаний, политических партий и государственных организаций.
Релизный цикл, информация об уязвимостях
График релизов
Количество 2 030
CVE-2022-25277
Drupal core sanitizes filenames with dangerous extensions upon upload ...
CVE-2022-25273
Drupal core's form API has a vulnerability where certain contributed o ...
CVE-2022-25276
The Media oEmbed iframe route does not properly validate the iframe do ...
CVE-2022-25278
Under certain circumstances, the Drupal core form API evaluates form e ...
CVE-2022-25274
Drupal 9.3 implemented a generic entity access API for entity revision ...
CVE-2022-25275
In some situations, the Image module does not correctly check access t ...
CVE-2023-31250
The file download facility doesn't sufficiently sanitize file paths in ...
CVE-2023-31250
The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.
GHSA-7jr4-hgqx-vwgq
Access bypass in Drupal core
GHSA-g36h-4jr6-qmm9
Improper input validation in Drupal core
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| CVE-2022-25277 Drupal core sanitizes filenames with dangerous extensions upon upload ... | CVSS3: 7.2 | 1% Низкий | больше 3 лет назад |
| CVE-2022-25273 Drupal core's form API has a vulnerability where certain contributed o ... | CVSS3: 7.5 | 1% Низкий | больше 3 лет назад |
| CVE-2022-25276 The Media oEmbed iframe route does not properly validate the iframe do ... | CVSS3: 6.1 | 1% Низкий | больше 3 лет назад |
| CVE-2022-25278 Under certain circumstances, the Drupal core form API evaluates form e ... | CVSS3: 6.5 | 1% Низкий | больше 3 лет назад |
| CVE-2022-25274 Drupal 9.3 implemented a generic entity access API for entity revision ... | CVSS3: 5.4 | 0% Низкий | больше 3 лет назад |
| CVE-2022-25275 In some situations, the Image module does not correctly check access t ... | CVSS3: 7.5 | 1% Низкий | больше 3 лет назад |
| CVE-2023-31250 The file download facility doesn't sufficiently sanitize file paths in ... | CVSS3: 6.5 | 1% Низкий | больше 3 лет назад |
 | CVE-2023-31250 The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating. | CVSS3: 6.5 | 1% Низкий | больше 3 лет назад |
| GHSA-7jr4-hgqx-vwgq Access bypass in Drupal core | CVSS3: 5.4 | 0% Низкий | больше 3 лет назад |
| GHSA-g36h-4jr6-qmm9 Improper input validation in Drupal core | CVSS3: 7.5 | 1% Низкий | больше 3 лет назад |
Уязвимостей на страницу