CVE-2025-31674

State: PUBLISHED · Published: 2025-03-31 · Updated: 2025-04-03 · Assigner: drupal

Description

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

CWE

CWE-915 — CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected

Drupal / Drupal core — v=8.0.0 <10.3.13 [affected]; v=10.4.0 <10.4.3 [affected]; v=11.0.0 <11.0.12 [affected]; v=11.1.0 <11.1.3 [affected]

CVSS

(none)

References

https://www.drupal.org/sa-core-2025-003

Source

cvelistV5-main/cves/2025/31xxx/CVE-2025-31674.json