CVE-2025-48921 - Vulnerability Details - OpenCVE

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-079

History

Thu, 26 Jun 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 26 Jun 2025 13:45:00 +0000

Type	Values Removed	Values Added
Description		Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.
Title		Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079
Weaknesses		CWE-352
References		https://www.drupal.org/sa-contrib-2025-079

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-06-26T13:32:44.948Z

Updated: 2025-06-26T17:46:14.613Z

Reserved: 2025-05-28T14:59:40.501Z

Link: CVE-2025-48921

Vulnrichment

Updated: 2025-06-26T17:46:02.235Z

NVD

Status : Awaiting Analysis

Published: 2025-06-26T14:15:30.043

Modified: 2025-06-26T18:57:43.670

Link: CVE-2025-48921

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-48921", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-05-28T14:59:40.501Z", "datePublished": "2025-06-26T13:32:44.948Z", "dateUpdated": "2025-06-26T17:46:14.613Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/social", "defaultStatus": "unaffected", "product": "Open Social", "repo": "https://git.drupalcode.org/project/social", "vendor": "Drupal", "versions": [{"lessThan": "12.3.14", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Ivo Van Geertruyen (mr.baileys)"}, {"lang": "en", "type": "remediation developer", "value": "Alexander Varwijk (kingdutch)"}, {"lang": "en", "type": "remediation developer", "value": "Robert Ragas (robertragas)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}], "datePublic": "2025-06-25T18:41:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.<p>This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.</p>"}], "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13."}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-06-26T13:32:44.948Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-079"}], "source": {"discovery": "UNKNOWN"}, "title": "Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-06-26T17:46:07.545071Z", "id": "CVE-2025-48921", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-26T17:46:14.613Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-48921", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-26T17:46:07.545071Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-26T17:46:02.235Z"}}], "cna": {"title": "Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Ivo Van Geertruyen (mr.baileys)"}, {"lang": "en", "type": "remediation developer", "value": "Alexander Varwijk (kingdutch)"}, {"lang": "en", "type": "remediation developer", "value": "Robert Ragas (robertragas)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/social", "vendor": "Drupal", "product": "Open Social", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "12.3.14", "versionType": "semver"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.13", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/social", "defaultStatus": "unaffected"}], "datePublic": "2025-06-25T18:41:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-079"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.<p>This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-06-26T13:32:44.948Z"}}}, "cveMetadata": {"cveId": "CVE-2025-48921", "state": "PUBLISHED", "dateUpdated": "2025-06-26T17:46:14.613Z", "dateReserved": "2025-05-28T14:59:40.501Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-06-26T13:32:44.948Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}