{"id":"CVE-2025-3131","aliases":["DRUPAL-CONTRIB-2025-031","EUVD-2025-10539","GHSA-fgg8-rprm-rg7v"],"status":"published","title":"ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2.*.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00182,"percentile":0.0782,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2025-04-09T17:04:15Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/eca","fixed_in":["1.1.12","2.0.16","2.1.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/eca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.12"}]},{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.16"}]},{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.7"}]}]}],"products":[{"vendor":"drupal","product":"eca: event - condition - action"},{"vendor":"drupal","product":"eca\\"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-031","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3131","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fgg8-rprm-rg7v"},{"url":"https://git.drupalcode.org/project/eca","tags":["web"]},{"url":"https://www.drupal.org/project/eca","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3131.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-3131","title":"ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2.*.","status":"published","published":"2025-04-09T17:47:34.125Z","modified":"2025-04-09T18:33:14.969Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:39.719629Z"}],"euvd":[{"id":"EUVD-2025-10539","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2.*.","status":"published","published":"2025-04-09T17:47:34Z","modified":"2025-04-09T18:33:14Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:38.263259Z"}],"ghsa":[{"id":"GHSA-fgg8-rprm-rg7v","title":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows...","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2.*.","status":"published","published":"2025-04-09T18:30:56Z","modified":"2025-04-09T21:32:48Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:01:03.275422Z"}],"nvd":[{"id":"CVE-2025-3131","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2.*.","status":"published","published":"2025-04-09T18:15:50.95Z","modified":"2026-06-17T09:19:14.603Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:11:00.087098Z"}],"osv":[{"id":"CVE-2025-3131","title":"ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2.*.","status":"published","published":"2025-04-09T17:47:34.125Z","modified":"2026-10-28T02:30:51.703820035Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"DRUPAL-CONTRIB-2025-031","description":"This module enables you to define automations on your Drupal site.\n\nThe module doesn't sufficiently protect certain routes from CSRF attacks.\n\nThis vulnerability can be mitigated by disabling the \"eca\\_ui\" submodule, which leaves ECA functionality intact, but the vulnerable routes will no longer be available.","status":"published","published":"2025-04-09T17:04:15Z","modified":"2026-09-10T03:45:39.152939287Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}