{"id":"CVE-2025-3475","aliases":["DRUPAL-CONTRIB-2025-030","EUVD-2025-10538","GHSA-65gx-jp3x-238j"],"status":"published","title":"WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030","description":"Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00454,"percentile":0.39666,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770","CWE-863"],"published":"2025-04-09T17:04:09Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/webt","fixed_in":["1.1.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/webt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}]}],"products":[{"vendor":"drupal","product":"web-t"},{"vendor":"europa","product":"web-t"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-030","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3475","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-65gx-jp3x-238j"},{"url":"https://git.drupalcode.org/project/webt","tags":["web"]},{"url":"https://www.drupal.org/project/webt","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3475.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-3475","title":"WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030","description":"Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.","status":"published","published":"2025-04-09T17:46:55.726Z","modified":"2025-04-09T18:36:41.734Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-770","CWE-863"],"updated_at":"2026-11-02T14:32:39.039362Z"}],"euvd":[{"id":"EUVD-2025-10538","description":"Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.","status":"published","published":"2025-04-09T17:46:55Z","modified":"2025-04-09T18:36:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:38.263259Z"}],"ghsa":[{"id":"GHSA-65gx-jp3x-238j","title":"Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in...","description":"Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.","status":"published","published":"2025-04-09T18:30:56Z","modified":"2025-04-09T21:32:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:01:03.275422Z"}],"nvd":[{"id":"CVE-2025-3475","description":"Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.","status":"published","published":"2025-04-09T18:15:51.17Z","modified":"2026-06-17T09:20:01.37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-770","CWE-863"],"updated_at":"2026-11-02T14:11:00.087098Z"}],"osv":[{"id":"CVE-2025-3475","title":"WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030","description":"Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.","status":"published","published":"2025-04-09T17:46:55.726Z","modified":"2026-10-28T02:30:33.217125602Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-770","CWE-863"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"DRUPAL-CONTRIB-2025-030","description":"This module enables you to translate nodes, configuration, UI strings automatically.\n\nThe module doesn't sufficiently validate the incoming API response when using eTranslation integration, which has an asynchronous workflow. Specially crafted requests could overwrite entities and translations of entities with arbitrary content and create load on the system leading to a Denial of Service.","status":"published","published":"2025-04-09T17:04:09Z","modified":"2026-09-10T03:46:18.532086716Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}