Vulnerability-Lookup

Vulnerability from drupal

Published

2025-01-22 17:01

Modified

2025-03-31 22:04

Summary

Details

This module enables you to render error pages using the Ignition package.

The module disables certain Drupal core code and does not perform sufficient filtering, allowing HTML to be injected in certain situations leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that this module is for development purposes and is not intended to be installed on production environments.

Credits

Dieter Holvoet www.drupal.org/user/3567222

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c1.0.4"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/ignition"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c1.0.4"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2025-31679"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/user/3567222"
      ],
      "name": "Dieter Holvoet"
    }
  ],
  "details": "This module enables you to render error pages using the Ignition package.\n\nThe module disables certain Drupal core code and does not perform sufficient filtering, allowing HTML to be injected in certain situations leading to a Cross Site Scripting (XSS) vulnerability.\n\nThis vulnerability is mitigated by the fact that this module is for development purposes and is not intended to be installed on production environments.",
  "id": "DRUPAL-CONTRIB-2025-007",
  "modified": "2025-03-31T22:04:03.000Z",
  "published": "2025-01-22T17:01:38.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2025-007"
    }
  ],
  "schema_version": "1.7.0"
}

CVE-2025-31679 (GCVE-0-2025-31679)

Vulnerability from cvelistv5 – Published: 2025-03-31 21:38 – Updated: 2025-04-29 15:39

Title

Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.

Severity ?

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

drupal

References

URL

Tags

https://www.drupal.org/sa-contrib-2025-007

Impacted products

	Vendor	Product	Version
	Drupal	Ignition Error Pages	Affected: 0.0.0 , < 1.0.4 (semver)

Credits

Dieter Holvoet catch Dieter Holvoet Heine Deelstra Greg Knaddison Juraj Nemec James Gilliland

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-31679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-01T18:21:30.666235Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T15:39:15.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/ignition",
          "defaultStatus": "unaffected",
          "product": "Ignition Error Pages",
          "repo": "https://git.drupalcode.org/project/ignition",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.0.4",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dieter Holvoet"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "catch"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dieter Holvoet"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Heine Deelstra"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "James Gilliland"
        }
      ],
      "datePublic": "2025-01-22T17:01:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).\u003cp\u003eThis issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-31T21:38:50.510Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2025-007"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2025-31679",
    "datePublished": "2025-03-31T21:38:50.510Z",
    "dateReserved": "2025-03-31T21:30:04.616Z",
    "dateUpdated": "2025-04-29T15:39:15.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

Vulnerability from drupal

CVE-2025-31679 (GCVE-0-2025-31679)

Tags

Sightings

Nomenclature