DRUPAL-CONTRIB-2025-110unknown
DRUPAL-CONTRIB-2025-110
The advisory, in context
This module allows you to use different currencies on your website and do currency conversion.
The module doesn't sufficiently protect routes used to enable and disable currencies from Cross-Site Request Forgery (CSRF) attacks, potentially allowing an attacker to trick an admin into changing settings.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/currency Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 3.5.0
Fixed in 3.5.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.0"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<3.5.0"
}
}
],
"versions": []
}