{"id":"CVE-2025-48921","aliases":["DRUPAL-CONTRIB-2025-079","EUVD-2025-19189","GHSA-g4c5-6283-5vcr"],"status":"published","title":"Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00181,"percentile":0.07803,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2025-06-25T18:41:34Z","modified":"2026-10-28T02:31:15Z","products":[{"vendor":"drupal","product":"open social"},{"vendor":"getopensocial","product":"open_social"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-079","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48921","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g4c5-6283-5vcr"},{"url":"https://git.drupalcode.org/project/social","tags":["web"]},{"url":"https://www.drupal.org/project/social","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48921.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-48921","title":"Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.","status":"published","published":"2025-06-26T13:32:44.948Z","modified":"2025-06-26T17:46:14.613Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:41.089134Z"}],"euvd":[{"id":"EUVD-2025-19189","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.","status":"published","published":"2025-06-26T13:32:44Z","modified":"2025-06-26T17:46:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:16.171648Z"}],"ghsa":[{"id":"GHSA-g4c5-6283-5vcr","title":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request...","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.","status":"published","published":"2025-06-26T18:31:25Z","modified":"2025-06-26T18:31:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:02:49.372577Z"}],"nvd":[{"id":"CVE-2025-48921","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.","status":"published","published":"2025-06-26T14:15:30.043Z","modified":"2026-06-17T09:30:29.053Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:11:14.781314Z"}],"osv":[{"id":"CVE-2025-48921","title":"Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.","status":"published","published":"2025-06-26T13:32:44.948Z","modified":"2026-10-28T02:31:15.040757721Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DRUPAL-CONTRIB-2025-079","description":"Open Social is a Drupal distribution for online communities, which ships with a default module that allows users to enroll in events.\n\nThe module doesn't sufficiently protect certain routes from Cross Site Request Forgery (CSRF) attacks. Users can be tricked into accepting or rejecting these enrollments.\n\nThis issue only affects sites that have event enrollments enabled for an event.","status":"withdrawn","published":"2025-06-25T18:41:34Z","modified":"2026-03-18T18:00:07.435939Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}