{"id":"GHSA-qq45-cqhg-jwx5","aliases":["CVE-2025-31688","DRUPAL-CONTRIB-2025-017"],"title":"Drupal Configuration Split Cross-Site Request Forgery (CSRF) vulnerability","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery. This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.","severity":"medium","score":6.8,"published":"2025-04-01T00:30:34.000Z","modified":"2025-12-10T23:40:59.564Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"drupal/config_split","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.10.0"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["1.10.0"]},{"ecosystem":"Packagist","name":"drupal/config_split","ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.0.2"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["2.0.2"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-31688","https://git.drupalcode.org/project/config_split","https://www.drupal.org/sa-contrib-2025-017"],"sources":[{"name":"OSV","id":"GHSA-qq45-cqhg-jwx5","modified":"2025-12-10T23:40:59.564506Z","url":"https://osv.dev/vulnerability/GHSA-qq45-cqhg-jwx5"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","score":6.8},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","score":2.4}]}