Improper input validation in Drupal core
Impact
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 8.0.0 before 9.2.18Ecosystem versions | 9.2.18 |
| From 9.3.0 before 9.3.12Ecosystem versions | 9.3.12 |
| From 8.0.0 before 9.2.18Ecosystem versions | 9.2.18 |
| From 9.3.0 before 9.3.12Ecosystem versions | 9.3.12 |
Version evidence: OSV · GHSA-g36h-4jr6-qmm9OSV · DRUPAL-CORE-2022-008
View original version evidence (484 explicit versions)
Original source description
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
We do not know of affected forms within core itself, but contributed and custom project forms could be affected. Installing this update will fix those forms.
This advisory is not covered by Drupal Steward.