{"id":"CVE-2025-31689","aliases":["CLSA-2026-1788971869","CLSA-2026-1788972898","CLSA-2026-1790249402","DRUPAL-CONTRIB-2025-018","EUVD-2025-9017","GHSA-jv6r-mj9p-9xff"],"status":"published","title":"General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00208,"percentile":0.11085,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2025-02-26T18:34:59Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"Packagist","package":"drupal/gdpr","fixed_in":["3.0.1","3.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"drupal/gdpr","fixed_in":["7.1.0-p1+tuxcare","3.1.0-p1+tuxcare","3.0.0-p1+tuxcare"],"sources":["osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/gdpr","fixed_in":["3.0.1","3.1.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/gdpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/gdpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.2"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/gdpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.1.0-p1+tuxcare"}]}],"versions":["7.1.0"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/gdpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.0-p1+tuxcare"}]}],"versions":["3.1.0"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/gdpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.0-p1+tuxcare"}]}],"versions":["3.0.0"]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/gdpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/gdpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/gdpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.2"}]}]}],"products":[{"vendor":"drupal","product":"general data protection regulation"},{"vendor":"general_data_protection_regulation_project","product":"general_data_protection_regulation"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-018","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31689","tags":["advisory"]},{"url":"https://git.drupalcode.org/project/gdpr/-/commit/d53f1cf1394c41c8885faaaaf576965161676e1f","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jv6r-mj9p-9xff"},{"url":"https://git.drupalcode.org/project/gdpr","tags":["web","package"]},{"url":"https://www.drupal.org/project/gdpr","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31689.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-31689","title":"General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.","status":"published","published":"2025-03-31T21:45:37.759Z","modified":"2025-04-29T15:25:26.911Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:44.763463Z"}],"euvd":[{"id":"EUVD-2025-9017","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.","status":"published","published":"2025-03-31T21:45:37Z","modified":"2025-04-29T15:25:26Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:00.449871Z"}],"ghsa":[{"id":"GHSA-jv6r-mj9p-9xff","title":"Drupal General Data Protection Regulation Cross-Site Request Forgery (CSRF) vulnerability","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery. This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-04-29T20:24:00Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2025-31689","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.","status":"published","published":"2025-03-31T22:15:21.517Z","modified":"2026-06-17T09:10:46.863Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:57.134561Z"}],"osv":[{"id":"CVE-2025-31689","title":"General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.","status":"published","published":"2025-03-31T21:45:37.759Z","modified":"2026-10-28T02:30:40.176082352Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-jv6r-mj9p-9xff","title":"Drupal General Data Protection Regulation Cross-Site Request Forgery (CSRF) vulnerability","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery. This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-12-10T23:41:03.627759Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"CLSA-2026-1788971869","title":"TuxCare security update for drupal/gdpr (1 CVE)","description":"TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 7.1.0-p1+tuxcare.","status":"published","published":"2026-09-09T16:37:49Z","modified":"2026-10-15T09:48:00.447034858Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1788972898","title":"TuxCare security update for drupal/gdpr (1 CVE)","description":"TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 3.1.0-p1+tuxcare.","status":"published","published":"2026-09-09T16:54:58Z","modified":"2026-10-15T09:48:00.444663182Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1790249402","title":"TuxCare security update for drupal/gdpr (1 CVE)","description":"TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 3.0.0-p1+tuxcare.","status":"published","published":"2026-09-24T11:30:02Z","modified":"2026-10-15T09:48:04.743696199Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"DRUPAL-CONTRIB-2025-018","description":"The GDPR Task submodule enables you to create GDPR tasks.\n\nThe module doesn't sufficiently protect against Cross Site Request Forgery (CSRF) attacks by validating user identity and intent when creating tasks.","status":"published","published":"2025-02-26T18:34:59Z","modified":"2026-09-10T03:45:32.553576471Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}