CVE-2022-25276

2023-04-2600:00:00

drupal

www.cve.org

media

oembed

iframe

validation

vulnerability

cross-site scripting

6.5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.2%

JSON

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

CNA Affected

[
  {
    "vendor": "Drupal",
    "product": "Core",
    "versions": [
      {
        "version": "9.4",
        "status": "affected",
        "lessThan": "9.4.3",
        "versionType": "custom"
      },
      {
        "version": "9.3",
        "status": "affected",
        "lessThan": "9.3.19",
        "versionType": "custom"
      }
    ]
  }
]