Research · Mar 19, 2025 · ZeroDay Catalog
Moderately Critical Cross Site Scripting Vulnerability in Drupal Core
A cross site scripting vulnerability has been identified in Drupal core, impacting various installations and requiring immediate attention from administrators.
What changed
A new vulnerability, identified as CVE-2025-31675, has been reported in Drupal core. This vulnerability is classified as moderately critical and involves cross site scripting (XSS), which could allow attackers to inject malicious scripts into web pages viewed by users.
The advisory for this issue is documented under SA-CORE-2025-004, highlighting the need for prompt action to mitigate potential risks.
Who is affected
The vulnerability affects all installations of Drupal core that have not yet applied the necessary patches. Organizations utilizing this content management system should be particularly vigilant.
Specific groups that may be impacted include web developers, site administrators, and organizations relying on Drupal for their online presence.
- Drupal core installations across various versions.
- Organizations using Drupal for content management.
- Web developers implementing Drupal-based solutions.
What to do
Administrators are urged to review the advisory SA-CORE-2025-004 and apply the recommended updates to their Drupal installations as soon as possible. This will help protect against potential exploitation of the XSS vulnerability.
Regular security audits and updates are essential to maintain the integrity of web applications.
- Review and apply updates as outlined in SA-CORE-2025-004.
- Conduct security audits on Drupal installations.
- Educate staff on the implications of XSS vulnerabilities.