{"id":"CVE-2025-31690","aliases":["DRUPAL-CONTRIB-2025-019","EUVD-2025-9039","GHSA-ccc9-jgj7-hxc7"],"status":"published","title":"Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00227,"percentile":0.13617,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2025-02-26T18:35:11Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"Packagist","package":"drupal/cache_utility","fixed_in":["1.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/cache_utility","fixed_in":["1.2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/cache_utility","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/cache_utility","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/cache_utility","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}]}],"products":[{"vendor":"cache_utility_project","product":"cache_utility"},{"vendor":"drupal","product":"cache utility"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-019","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31690","tags":["advisory"]},{"url":"https://git.drupalcode.org/project/cache_utility/-/commit/1abf7a438d56ccb11ee3cdac9bdd1707f369ab9e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ccc9-jgj7-hxc7"},{"url":"https://git.drupalcode.org/project/cache_utility","tags":["web","package"]},{"url":"https://www.drupal.org/project/cache_utility","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31690.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-31690","title":"Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.","status":"published","published":"2025-03-31T21:49:18.3Z","modified":"2025-04-29T15:23:27.313Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:44.424933Z"}],"euvd":[{"id":"EUVD-2025-9039","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.","status":"published","published":"2025-03-31T21:49:18Z","modified":"2025-04-29T15:23:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:00.449871Z"}],"ghsa":[{"id":"GHSA-ccc9-jgj7-hxc7","title":"Drupal Cache Utility Cross-Site Request Forgery (CSRF) vulnerability","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery. This issue affects Cache Utility: from 0.0.0 before 1.2.1.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-04-29T20:25:02Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2025-31690","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.","status":"published","published":"2025-03-31T22:15:21.623Z","modified":"2026-06-17T09:10:47Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:57.134561Z"}],"osv":[{"id":"CVE-2025-31690","title":"Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.","status":"published","published":"2025-03-31T21:49:18.3Z","modified":"2026-10-28T02:30:22.315459539Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-ccc9-jgj7-hxc7","title":"Drupal Cache Utility Cross-Site Request Forgery (CSRF) vulnerability","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery. This issue affects Cache Utility: from 0.0.0 before 1.2.1.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-12-10T23:41:12.463277Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"DRUPAL-CONTRIB-2025-019","description":"The Cache Utility module provides an ability to view status and flush various caches.\n\nThe module doesn't sufficiently protect against Cross Site Request Forgery (CSRF) attacks by validating user identity and intent when flushing a cache.","status":"published","published":"2025-02-26T18:35:11Z","modified":"2026-09-10T03:45:35.90359303Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}