{"id":"CVE-2025-47701","aliases":["DRUPAL-CONTRIB-2025-047","EUVD-2025-14937","GHSA-9m42-x6rr-h5qc"],"status":"published","title":"Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.This issue affects Restrict route by IP: from 0.0.0 before 1.3.0.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00201,"percentile":0.10113,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2025-05-07T17:06:16Z","modified":"2026-10-28T02:30:52Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/restrict_route_by_ip","fixed_in":["1.3.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/restrict_route_by_ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}]}],"products":[{"vendor":"drupal","product":"restrict route by ip"},{"vendor":"restrict_route_by_ip_project","product":"restrict_route_by_ip"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-047","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47701","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9m42-x6rr-h5qc"},{"url":"https://git.drupalcode.org/project/restrict_route_by_ip","tags":["web"]},{"url":"https://www.drupal.org/project/restrict_route_by_ip","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47701.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-47701","title":"Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.This issue affects Restrict route by IP: from 0.0.0 before 1.3.0.","status":"published","published":"2025-05-14T17:01:18.96Z","modified":"2025-05-20T16:19:12.229Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:25.982948Z"}],"euvd":[{"id":"EUVD-2025-14937","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.This issue affects Restrict route by IP: from 0.0.0 before 1.3.0.","status":"published","published":"2025-05-14T17:01:18Z","modified":"2025-05-20T16:19:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:43.363755Z"}],"ghsa":[{"id":"GHSA-9m42-x6rr-h5qc","title":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site...","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.This issue affects Restrict route by IP: from 0.0.0 before 1.3.0.","status":"published","published":"2025-05-14T18:30:48Z","modified":"2025-05-20T18:31:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:02:23.05875Z"}],"nvd":[{"id":"CVE-2025-47701","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.This issue affects Restrict route by IP: from 0.0.0 before 1.3.0.","status":"published","published":"2025-05-14T17:15:49.27Z","modified":"2026-06-17T09:28:34.553Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:11:08.321805Z"}],"osv":[{"id":"CVE-2025-47701","title":"Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.This issue affects Restrict route by IP: from 0.0.0 before 1.3.0.","status":"published","published":"2025-05-14T17:01:18.96Z","modified":"2026-10-28T02:30:52.786385342Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"DRUPAL-CONTRIB-2025-047","description":"The Restrict route by IP module provides an interface to manage route restriction by IP address.\n\nThe module doesn't sufficiently protect certain routes from CSRF attacks.\n\nThis vulnerability is mitigated by the fact that you need to know the route machine name.","status":"published","published":"2025-05-07T17:06:16Z","modified":"2026-09-10T03:45:15.176293837Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}