Every CVE Search/ Get API key

CVE-2022-25276

Lack of domain validation in Druple core

6.1 MediumFix available

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.53%Up 0.5 points since Apr 27, 2023
90%50%10%1%

What each source reports

NVD Score used 6.1

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Record
CVE-2022-25276
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List 6.1

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Record
CVE-2022-25276
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2023-1196 6.1

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Record
EUVD-2023-1196
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-4wfq-jc9h-vpcx 6.1

Lack of domain validation in Druple core

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Drupal 7 core does not include the Media module and therefore is not affected.

Record
GHSA-4wfq-jc9h-vpcx
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
GitHub AdvisoriesGHSA-6ccv-8fgf-cjpw No score

Drupal core Denial of Service vulnerability

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Record
GHSA-6ccv-8fgf-cjpw
Updated
2026-11-02
OSV 6.1

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Record
CVE-2022-25276
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-4wfq-jc9h-vpcx 6.1

Lack of domain validation in Druple core

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Drupal 7 core does not include the Media module and therefore is not affected.

Record
GHSA-4wfq-jc9h-vpcx
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2022-25276 6.1

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Record
UBUNTU-CVE-2022-25276
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVBIT-drupal-2022-25276 No score

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Record
BIT-drupal-2022-25276
Updated
2026-11-02
OSVCLSA-2026-1784682869 No score

TuxCare security update for drupal/core (21 CVEs)

TuxCare rebuilt drupal/core to address 21 CVEs. Fixed in 8.9.20-p1+tuxcare.

Record
CLSA-2026-1784682869
Updated
2026-11-02
OSVDRUPAL-CORE-2022-015 No score

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

This advisory is not covered by Drupal Steward.

Record
DRUPAL-CORE-2022-015
Updated
2026-11-02
OSVGHSA-6ccv-8fgf-cjpw No score

Drupal core Denial of Service vulnerability

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Record
GHSA-6ccv-8fgf-cjpw
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
drupal/core
Packagist
 8.0.0 up to 9.3.19
9.3.19
drupal/core
Packagist
 9.4.0 up to 9.4.3
9.4.3
drupal/core
Packagist
 8.0.0 up to 10.1.8
10.1.8
drupal/core
Packagist
 10.2.0 up to 10.2.2
10.2.2
drupal
Bitnami
 9.3.0 up to 9.3.19, 9.4.0 up to 9.4.3
9.3.199.4.3
drupal/core
TuxCare:Packagist
From an advisory covering 20 CVEs
 8.9.20 up to 8.9.20-p1+tuxcare
8.9.20-p1+tuxcare
drupal/core
Packagist
 8.0.0 up to 9.3.19, 9.4.0 up to 9.4.3, plus listed versions
8.0.18.0.28.0.38.0.48.0.5
Show 45 moreShow less
8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1
9.3.199.4.3
drupal/core
Packagist
 8.0.0 up to 9.3.19, plus listed versions
8.0.18.0.28.0.38.0.48.0.5
Show 45 moreShow less
8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1
9.3.19
drupal/core
Packagist
 9.4.0 up to 9.4.3, plus listed versions
9.4.19.4.2
9.4.3
drupal/core
Packagist
 8.0.0 up to 10.1.8, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.78.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.4
10.1.8
drupal/core
Packagist
 10.2.0 up to 10.2.2, plus listed versions
10.2.1
10.2.2
drupal7
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3
 None known
drupal7
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
7.38-17.41-17.44-1ubuntu1~16.04.07.44-1ubuntu1~16.04.0+esm17.44-1ubuntu1~16.04.0+esm27.44-1ubuntu1~16.04.0+esm3
 None known

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-25276 is a medium vulnerability (CVSS 6.1) in Drupal Core, published July 20, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in drupal/core 9.3.19.

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 698 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open