CVE-2025-3475 - Vulnerability Details - OpenCVE

Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Europa	Web-t

Configuration 1 [-]

cpe:2.3:a:europa:web-t:*:*:*:*:*:drupal:*:*

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-030

History

Mon, 02 Jun 2025 17:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Europa Europa web-t
CPEs	cpe:2.3:a:drupal:web-t::::::drupal::*	cpe:2.3:a:europa:web-t::::::drupal::*
Vendors & Products	Drupal Drupal web-t	Europa Europa web-t

Thu, 01 May 2025 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal web-t
CPEs		cpe:2.3:a:drupal:web-t::::::drupal::*
Vendors & Products		Drupal Drupal web-t

Wed, 09 Apr 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 09 Apr 2025 18:00:00 +0000

Type	Values Removed	Values Added
Description		Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.
Title		WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030
Weaknesses		CWE-770 CWE-863
References		https://www.drupal.org/sa-contrib-2025-030

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-04-09T17:46:55.726Z

Updated: 2025-04-09T18:36:41.734Z

Reserved: 2025-04-09T16:30:42.269Z

Link: CVE-2025-3475

Vulnrichment

Updated: 2025-04-09T18:34:37.025Z

NVD

Status : Analyzed

Published: 2025-04-09T18:15:51.170

Modified: 2025-06-02T17:23:36.020

Link: CVE-2025-3475

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3475", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-04-09T16:30:42.269Z", "datePublished": "2025-04-09T17:46:55.726Z", "dateUpdated": "2025-04-09T18:36:41.734Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/webt", "defaultStatus": "unaffected", "product": "WEB-T", "repo": "https://git.drupalcode.org/project/webt", "vendor": "Drupal", "versions": [{"lessThan": "1.1.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jan Kellermann (jan kellermann)"}, {"lang": "en", "type": "remediation developer", "value": "dragels"}, {"lang": "en", "type": "remediation developer", "value": "Jan Kellermann (jan kellermann)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "datePublic": "2025-04-09T17:04:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.<p>This issue affects WEB-T: from 0.0.0 before 1.1.0.</p>"}], "value": "Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}, {"capecId": "CAPEC-148", "descriptions": [{"lang": "en", "value": "CAPEC-148 Content Spoofing"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-04-09T17:46:55.726Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-030"}], "source": {"discovery": "UNKNOWN"}, "title": "WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-09T18:34:14.161994Z", "id": "CVE-2025-3475", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-09T18:36:41.734Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-3475", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-09T18:34:14.161994Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-09T18:34:37.025Z"}}], "cna": {"title": "WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jan Kellermann (jan kellermann)"}, {"lang": "en", "type": "remediation developer", "value": "dragels"}, {"lang": "en", "type": "remediation developer", "value": "Jan Kellermann (jan kellermann)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}, {"capecId": "CAPEC-148", "descriptions": [{"lang": "en", "value": "CAPEC-148 Content Spoofing"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/webt", "vendor": "Drupal", "product": "WEB-T", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.1.0", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/webt", "defaultStatus": "unaffected"}], "datePublic": "2025-04-09T17:04:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-030"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.", "supportingMedia": [{"type": "text/html", "value": "Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.<p>This issue affects WEB-T: from 0.0.0 before 1.1.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-04-09T17:46:55.726Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3475", "state": "PUBLISHED", "dateUpdated": "2025-04-09T18:36:41.734Z", "dateReserved": "2025-04-09T16:30:42.269Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-04-09T17:46:55.726Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}