CVE-2025-3057 - Vulnerability Details

Vendors	Products
Drupal	Drupal

Link	Providers
https://www.drupal.org/sa-core-2025-001

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal drupal
CPEs		cpe:2.3:a:drupal:drupal::::::::
Vendors & Products		Drupal Drupal drupal

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
Title		Drupal core - Critical - Cross site scripting - SA-CORE-2025-001
Weaknesses		CWE-79
References		https://www.drupal.org/sa-core-2025-001

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3057", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-03-31T21:30:27.253Z", "datePublished": "2025-03-31T21:33:30.184Z", "dateUpdated": "2025-04-01T13:29:23.644Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/drupal", "defaultStatus": "unaffected", "product": "Drupal core", "repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "versions": [{"lessThan": "10.3.13", "status": "affected", "version": "8.0.0", "versionType": "semver"}, {"lessThan": "10.4.3", "status": "affected", "version": "10.4.0", "versionType": "semver"}, {"lessThan": "11.0.12", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThan": "11.1.3", "status": "affected", "version": "11.1.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Arne (arkepp)"}, {"lang": "en", "type": "finder", "value": "bdanin"}, {"lang": "en", "type": "finder", "value": "Douglas Groene (dgroene)"}, {"lang": "en", "type": "finder", "value": "Dragos Dumitrescu (dragos-dumi)"}, {"lang": "en", "type": "finder", "value": "Flo Kosiol (flokosiol)"}, {"lang": "en", "type": "finder", "value": "Gerardo Cadau (juanramonperez)"}, {"lang": "en", "type": "finder", "value": "Justin Christoffersen (larsdesigns)"}, {"lang": "en", "type": "finder", "value": "nuwans"}, {"lang": "en", "type": "finder", "value": "Sven Decabooter (svendecabooter)"}, {"lang": "en", "type": "finder", "value": "Will Gunn (wgunn_e)"}, {"lang": "en", "type": "remediation developer", "value": "catch (catch)"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber (mcdruid)"}], "datePublic": "2025-02-19T16:49:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).<p>This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-03-31T21:33:30.184Z"}, "references": [{"url": "https://www.drupal.org/sa-core-2025-001"}], "source": {"discovery": "UNKNOWN"}, "title": "Drupal core - Critical - Cross site scripting - SA-CORE-2025-001", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-01T13:26:50.934330Z", "id": "CVE-2025-3057", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-01T13:29:23.644Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-3057 (string)

assignerOrgId : 2c85b837-eb8b-40ed-9d74-228c62987387 (string)

state : PUBLISHED (string)

assignerShortName : drupal (string)

dateReserved : 2025-03-31T21:30:27.253Z (string)

datePublished : 2025-03-31T21:33:30.184Z (string)

dateUpdated : 2025-04-01T13:29:23.644Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

collectionURL : https://www.drupal.org/project/drupal (string)

defaultStatus : unaffected (string)

product : Drupal core (string)

repo : https://git.drupalcode.org/project/drupal (string)

vendor : Drupal (string)

versions : [ »

0 : { »

lessThan : 10.3.13 (string)

status : affected (string)

version : 8.0.0 (string)

versionType : semver (string)

}

1 : { »

lessThan : 10.4.3 (string)

status : affected (string)

version : 10.4.0 (string)

versionType : semver (string)

}

2 : { »

lessThan : 11.0.12 (string)

status : affected (string)

version : 11.0.0 (string)

versionType : semver (string)

}

3 : { »

lessThan : 11.1.3 (string)

status : affected (string)

version : 11.1.0 (string)

versionType : semver (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Arne (arkepp) (string)

}

1 : { »

lang : en (string)

type : finder (string)

value : bdanin (string)

}

2 : { »

lang : en (string)

type : finder (string)

value : Douglas Groene (dgroene) (string)

}

3 : { »

lang : en (string)

type : finder (string)

value : Dragos Dumitrescu (dragos-dumi) (string)

}

4 : { »

lang : en (string)

type : finder (string)

value : Flo Kosiol (flokosiol) (string)

}

5 : { »

lang : en (string)

type : finder (string)

value : Gerardo Cadau (juanramonperez) (string)

}

6 : { »

lang : en (string)

type : finder (string)

value : Justin Christoffersen (larsdesigns) (string)

}

7 : { »

lang : en (string)

type : finder (string)

value : nuwans (string)

}

8 : { »

lang : en (string)

type : finder (string)

value : Sven Decabooter (svendecabooter) (string)

}

9 : { »

lang : en (string)

type : finder (string)

value : Will Gunn (wgunn_e) (string)

}

10 : { »

lang : en (string)

type : remediation developer (string)

value : catch (catch) (string)

}

11 : { »

lang : en (string)

type : remediation developer (string)

value : Drew Webber (mcdruid) (string)

}

]

datePublic : 2025-02-19T16:49:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).<p>This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.</p> (string)

}

]

value : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-63 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-63 Cross-Site Scripting (XSS) (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-79 (string)

description : CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 2c85b837-eb8b-40ed-9d74-228c62987387 (string)

shortName : drupal (string)

dateUpdated : 2025-03-31T21:33:30.184Z (string)

}

references : [ »

0 : { »

url : https://www.drupal.org/sa-core-2025-001 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Drupal core - Critical - Cross site scripting - SA-CORE-2025-001 (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : CHANGED (string)

version : 3.1 (string)

baseScore : 6.1 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-01T13:26:50.934330Z (string)

id : CVE-2025-3057 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-01T13:29:23.644Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-3057", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-01T13:26:50.934330Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-01T13:27:22.140Z"}}], "cna": {"title": "Drupal core - Critical - Cross site scripting - SA-CORE-2025-001", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Arne (arkepp)"}, {"lang": "en", "type": "finder", "value": "bdanin"}, {"lang": "en", "type": "finder", "value": "Douglas Groene (dgroene)"}, {"lang": "en", "type": "finder", "value": "Dragos Dumitrescu (dragos-dumi)"}, {"lang": "en", "type": "finder", "value": "Flo Kosiol (flokosiol)"}, {"lang": "en", "type": "finder", "value": "Gerardo Cadau (juanramonperez)"}, {"lang": "en", "type": "finder", "value": "Justin Christoffersen (larsdesigns)"}, {"lang": "en", "type": "finder", "value": "nuwans"}, {"lang": "en", "type": "finder", "value": "Sven Decabooter (svendecabooter)"}, {"lang": "en", "type": "finder", "value": "Will Gunn (wgunn_e)"}, {"lang": "en", "type": "remediation developer", "value": "catch (catch)"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber (mcdruid)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "product": "Drupal core", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "10.3.13", "versionType": "semver"}, {"status": "affected", "version": "10.4.0", "lessThan": "10.4.3", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.0.12", "versionType": "semver"}, {"status": "affected", "version": "11.1.0", "lessThan": "11.1.3", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/drupal", "defaultStatus": "unaffected"}], "datePublic": "2025-02-19T16:49:00.000Z", "references": [{"url": "https://www.drupal.org/sa-core-2025-001"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).<p>This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-03-31T21:33:30.184Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3057", "state": "PUBLISHED", "dateUpdated": "2025-04-01T13:29:23.644Z", "dateReserved": "2025-03-31T21:30:27.253Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-03-31T21:33:30.184Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : CHANGED (string)

version : 3.1 (string)

baseScore : 6.1 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-3057 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-01T13:26:50.934330Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-01T13:27:22.140Z (string)

}

]

cna : { »

title : Drupal core - Critical - Cross site scripting - SA-CORE-2025-001 (string)

source : { »

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Arne (arkepp) (string)

}

1 : { »

lang : en (string)

type : finder (string)

value : bdanin (string)

}

2 : { »

lang : en (string)

type : finder (string)

value : Douglas Groene (dgroene) (string)

}

3 : { »

lang : en (string)

type : finder (string)

value : Dragos Dumitrescu (dragos-dumi) (string)

}

4 : { »

lang : en (string)

type : finder (string)

value : Flo Kosiol (flokosiol) (string)

}

5 : { »

lang : en (string)

type : finder (string)

value : Gerardo Cadau (juanramonperez) (string)

}

6 : { »

lang : en (string)

type : finder (string)

value : Justin Christoffersen (larsdesigns) (string)

}

7 : { »

lang : en (string)

type : finder (string)

value : nuwans (string)

}

8 : { »

lang : en (string)

type : finder (string)

value : Sven Decabooter (svendecabooter) (string)

}

9 : { »

lang : en (string)

type : finder (string)

value : Will Gunn (wgunn_e) (string)

}

10 : { »

lang : en (string)

type : remediation developer (string)

value : catch (catch) (string)

}

11 : { »

lang : en (string)

type : remediation developer (string)

value : Drew Webber (mcdruid) (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-63 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-63 Cross-Site Scripting (XSS) (string)

}

]

}

]

affected : [ »

0 : { »

repo : https://git.drupalcode.org/project/drupal (string)

vendor : Drupal (string)

product : Drupal core (string)

versions : [ »

0 : { »

status : affected (string)

version : 8.0.0 (string)

lessThan : 10.3.13 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 10.4.0 (string)

lessThan : 10.4.3 (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 11.0.0 (string)

lessThan : 11.0.12 (string)

versionType : semver (string)

}

3 : { »

status : affected (string)

version : 11.1.0 (string)

lessThan : 11.1.3 (string)

versionType : semver (string)

}

]

collectionURL : https://www.drupal.org/project/drupal (string)

defaultStatus : unaffected (string)

}

]

datePublic : 2025-02-19T16:49:00.000Z (string)

references : [ »

0 : { »

url : https://www.drupal.org/sa-core-2025-001 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).<p>This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.</p> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-79 (string)

description : CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (string)

}

]

}

]

providerMetadata : { »

orgId : 2c85b837-eb8b-40ed-9d74-228c62987387 (string)

shortName : drupal (string)

dateUpdated : 2025-03-31T21:33:30.184Z (string)

}

cveMetadata : { »

cveId : CVE-2025-3057 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-01T13:29:23.644Z (string)

dateReserved : 2025-03-31T21:30:27.253Z (string)

assignerOrgId : 2c85b837-eb8b-40ed-9d74-228c62987387 (string)

datePublished : 2025-03-31T21:33:30.184Z (string)

assignerShortName : drupal (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "61A4CA72-F83D-442A-9139-A2181856DBA2", "versionEndExcluding": "10.3.13", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "995C04AD-296A-458A-B7BF-D23212E152E1", "versionEndExcluding": "10.4.3", "versionStartIncluding": "10.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "249BE2B2-4C47-471B-99C4-F9E88984E13E", "versionEndExcluding": "11.0.12", "versionStartIncluding": "11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "3C6BF080-5C8B-4047-9EB2-1983E49C3744", "versionEndExcluding": "11.1.3", "versionStartIncluding": "11.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3."}, {"lang": "es", "value": "Vulnerabilidad de neutralizaci\u00f3n incorrecta de entrada durante la generaci\u00f3n de p\u00e1ginas web ('Cross-site Scripting') en Drupal Drupal core permite Cross-Site Scripting (XSS). Este problema afecta al n\u00facleo de Drupal: desde 8.0.0 antes de 10.3.13, desde 10.4.0 antes de 10.4.3, desde 11.0.0 antes de 11.0.12, desde 11.1.0 antes de 11.1.3."}], "id": "CVE-2025-3057", "lastModified": "2025-04-15T14:31:28.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2025-03-31T22:15:23.363", "references": [{"source": "mlhess@drupal.org", "tags": ["Vendor Advisory"], "url": "https://www.drupal.org/sa-core-2025-001"}], "sourceIdentifier": "mlhess@drupal.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "mlhess@drupal.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 61A4CA72-F83D-442A-9139-A2181856DBA2 (string)

versionEndExcluding : 10.3.13 (string)

versionStartIncluding : 8.0.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 995C04AD-296A-458A-B7BF-D23212E152E1 (string)

versionEndExcluding : 10.4.3 (string)

versionStartIncluding : 10.4.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 249BE2B2-4C47-471B-99C4-F9E88984E13E (string)

versionEndExcluding : 11.0.12 (string)

versionStartIncluding : 11.0.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 3C6BF080-5C8B-4047-9EB2-1983E49C3744 (string)

versionEndExcluding : 11.1.3 (string)

versionStartIncluding : 11.1.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de neutralización incorrecta de entrada durante la generación de páginas web ('Cross-site Scripting') en Drupal Drupal core permite Cross-Site Scripting (XSS). Este problema afecta al núcleo de Drupal: desde 8.0.0 antes de 10.3.13, desde 10.4.0 antes de 10.4.3, desde 11.0.0 antes de 11.0.12, desde 11.1.0 antes de 11.1.3. (string)

}

]

id : CVE-2025-3057 (string)

lastModified : 2025-04-15T14:31:28.273 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2025-03-31T22:15:23.363 (string)

references : [ »

0 : { »

source : mlhess@drupal.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.drupal.org/sa-core-2025-001 (string)

}

]

sourceIdentifier : mlhess@drupal.org (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : mlhess@drupal.org (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object