CVE-2025-9954 - Vulnerability Details - OpenCVE

Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Acquia	Dam
Drupal	Acquia Dam Drupal

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-105

History

Thu, 30 Oct 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 30 Oct 2025 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Acquia Acquia dam Drupal Drupal acquia Dam Drupal drupal
Vendors & Products		Acquia Acquia dam Drupal Drupal acquia Dam Drupal drupal

Wed, 29 Oct 2025 23:30:00 +0000

Type	Values Removed	Values Added
Description		Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.
Title		Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105
Weaknesses		CWE-862
References		https://www.drupal.org/sa-contrib-2025-105

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-10-29T23:12:41.751Z

Updated: 2025-10-30T14:45:16.263Z

Reserved: 2025-09-03T14:46:35.965Z

Link: CVE-2025-9954

Vulnrichment

Updated: 2025-10-30T14:45:10.049Z

NVD

Status : Awaiting Analysis

Published: 2025-10-30T00:15:35.137

Modified: 2025-10-30T15:15:46.630

Link: CVE-2025-9954

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9954", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-09-03T14:46:35.965Z", "datePublished": "2025-10-29T23:12:41.751Z", "dateUpdated": "2025-10-30T14:45:16.263Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/acquia_dam", "defaultStatus": "unaffected", "product": "Acquia DAM", "repo": "https://git.drupalcode.org/project/acquia_dam", "vendor": "Drupal", "versions": [{"lessThan": "1.1.5", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Brandon Goodwin (bgoodie)"}, {"lang": "en", "type": "finder", "value": "Chris Burge (chris burge)"}, {"lang": "en", "type": "finder", "value": "Todd Woofenden (toddwoof)"}, {"lang": "en", "type": "remediation developer", "value": "Chris Burge (chris burge)"}, {"lang": "en", "type": "remediation developer", "value": "Damien McKenna (damienmckenna)"}, {"lang": "en", "type": "remediation developer", "value": "Jakob P (japerry)"}, {"lang": "en", "type": "remediation developer", "value": "Todd Woofenden (toddwoof)"}, {"lang": "en", "type": "coordinator", "value": "cilefen (cilefen)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Cathy Theys (yesct)"}], "datePublic": "2025-09-03T16:15:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.<p>This issue affects Acquia DAM: from 0.0.0 before 1.1.5.</p>"}], "value": "Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5."}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-10-29T23:12:41.751Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-105"}], "source": {"discovery": "UNKNOWN"}, "title": "Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105", "x_generator": {"engine": "Vulnogram 0.4.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-30T14:44:50.718831Z", "id": "CVE-2025-9954", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T14:45:16.263Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Brandon Goodwin (bgoodie)"}, {"lang": "en", "type": "finder", "value": "Chris Burge (chris burge)"}, {"lang": "en", "type": "finder", "value": "Todd Woofenden (toddwoof)"}, {"lang": "en", "type": "remediation developer", "value": "Chris Burge (chris burge)"}, {"lang": "en", "type": "remediation developer", "value": "Damien McKenna (damienmckenna)"}, {"lang": "en", "type": "remediation developer", "value": "Jakob P (japerry)"}, {"lang": "en", "type": "remediation developer", "value": "Todd Woofenden (toddwoof)"}, {"lang": "en", "type": "coordinator", "value": "cilefen (cilefen)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Cathy Theys (yesct)"}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/acquia_dam", "vendor": "Drupal", "product": "Acquia DAM", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.1.5", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/acquia_dam", "defaultStatus": "unaffected"}], "datePublic": "2025-09-03T16:15:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-105"}], "x_generator": {"engine": "Vulnogram 0.4.0"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.<p>This issue affects Acquia DAM: from 0.0.0 before 1.1.5.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-10-29T23:12:41.751Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-9954", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T14:44:50.718831Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-10-30T14:45:10.049Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-9954", "state": "PUBLISHED", "dateUpdated": "2025-10-29T23:12:41.751Z", "dateReserved": "2025-09-03T14:46:35.965Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-10-29T23:12:41.751Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}