{"id":"CVE-2025-3907","aliases":["DRUPAL-CONTRIB-2025-046","EUVD-2025-12173","GHSA-5rww-hpvh-w7p4"],"status":"published","title":"Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00154,"percentile":0.04525,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2025-04-23T16:59:33Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/search_api_solr","fixed_in":["4.3.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/search_api_solr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.9"}]}]}],"products":[{"vendor":"drunkenmonkey","product":"search_api_solr"},{"vendor":"drupal","product":"search api solr"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-046","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3907","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5rww-hpvh-w7p4"},{"url":"https://git.drupalcode.org/project/search_api_solr","tags":["web"]},{"url":"https://www.drupal.org/project/search_api_solr","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3907.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-3907","title":"Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9.","status":"published","published":"2025-04-23T17:08:59.452Z","modified":"2025-04-23T17:53:57.671Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:39.719629Z"}],"euvd":[{"id":"EUVD-2025-12173","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9.","status":"published","published":"2025-04-23T17:08:59Z","modified":"2025-04-23T17:53:57Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:10.363195Z"}],"ghsa":[{"id":"GHSA-5rww-hpvh-w7p4","title":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site...","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9.","status":"published","published":"2025-04-23T18:31:00Z","modified":"2025-04-23T18:31:07Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:02:00.180386Z"}],"nvd":[{"id":"CVE-2025-3907","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9.","status":"published","published":"2025-04-23T17:16:56.273Z","modified":"2026-06-17T09:20:54.23Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:11:01.507281Z"}],"osv":[{"id":"CVE-2025-3907","title":"Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9.","status":"published","published":"2025-04-23T17:08:59.452Z","modified":"2026-10-28T02:30:22.592929371Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:49.052395Z"},{"id":"DRUPAL-CONTRIB-2025-046","description":"This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module.\n\nThe module doesn't sufficiently protect certain routes from CSRF attacks.\n\nThis vulnerability is mitigated by the fact that a site admin would have to perform further steps after the attack for it to have any effect.","status":"published","published":"2025-04-23T16:59:33Z","modified":"2026-09-10T03:45:16.363147297Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}