CVE catalog
CVE-2022-25278
UBUNTU-CVE-2022-25278
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.59% · Oct 25, 2026
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | drupal7 | pro | 7.23-1 | vulnerable |
| Ubuntu | drupal7 | pro | 7.24-1 | vulnerable |
| Ubuntu | drupal7 | pro | 7.24-2 | vulnerable |
| Ubuntu | drupal7 | pro | 7.26-1 | vulnerable |
| Ubuntu | drupal7 | pro | 7.26-1ubuntu0.1 | vulnerable |
| Ubuntu | drupal7 | pro | 7.26-1ubuntu0.1+esm1 | vulnerable |
| Ubuntu | drupal7 | pro | 7.26-1ubuntu0.1+esm2 | vulnerable |
| Ubuntu | drupal7 | pro | 7.26-1ubuntu0.1+esm3 | vulnerable |
| Ubuntu | drupal7 | pro | 7.38-1 | vulnerable |
| Ubuntu | drupal7 | pro | 7.41-1 | vulnerable |
| Ubuntu | drupal7 | pro | 7.44-1ubuntu1~16.04.0 | vulnerable |
| Ubuntu | drupal7 | pro | 7.44-1ubuntu1~16.04.0+esm1 | vulnerable |
| Ubuntu | drupal7 | pro | 7.44-1ubuntu1~16.04.0+esm2 | vulnerable |
| Ubuntu | drupal7 | pro | 7.44-1ubuntu1~16.04.0+esm3 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: