{"id":"CVE-2025-9551","aliases":["CLSA-2026-1789633295","DRUPAL-CONTRIB-2025-101","EUVD-2025-33789","GHSA-c25q-57mr-rv37"],"status":"published","title":"Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.0037,"percentile":0.31168,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-307"],"published":"2025-08-27T17:19:59Z","modified":"2026-10-15T09:48:00Z","fixes":[{"ecosystem":"TuxCare:Packagist","package":"drupal/protected_pages","fixed_in":["7.2.4-p1+tuxcare"],"sources":["osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/protected_pages","fixed_in":["1.8.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/protected_pages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.2.4"},{"fixed":"7.2.4-p1+tuxcare"}]}],"versions":["7.2.4"]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/protected_pages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]}],"products":[{"vendor":"drupal","product":"protected pages"},{"vendor":"protected_pages_project","product":"protected_pages"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-101","tags":["vendor-advisory","Patch","Vendor Advisory","web"]},{"url":"https://docs.herodevs.com/drupal/release-notes/protected-pages","tags":["third-party-advisory"]},{"url":"https://d7es.tag1.com/security-advisories/protected-pages-moderately-critical-access-bypass-sa-contrib-2025-101","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9551"},{"url":"https://github.com/advisories/GHSA-c25q-57mr-rv37"}],"sources":{"cve":[{"id":"CVE-2025-9551","title":"Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.","status":"published","published":"2025-10-10T22:24:59.07Z","modified":"2026-03-26T21:22:21.19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:32:33.755525Z"}],"euvd":[{"id":"EUVD-2025-33789","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.","status":"published","published":"2025-10-10T22:24:59Z","modified":"2026-03-26T21:22:21Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:25:27.67679Z"}],"ghsa":[{"id":"GHSA-c25q-57mr-rv37","title":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages...","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0.","status":"published","published":"2025-10-11T00:30:19Z","modified":"2026-03-27T00:32:23Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:06:54.074781Z"}],"nvd":[{"id":"CVE-2025-9551","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.","status":"published","published":"2025-10-10T23:15:37.287Z","modified":"2026-10-08T13:10:00.2Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:11:36.851295Z"}],"osv":[{"id":"CLSA-2026-1789633295","title":"TuxCare security update for drupal/protected_pages (1 CVE)","description":"TuxCare rebuilt drupal/protected_pages to address 1 CVE. Fixed in 7.2.4-p1+tuxcare.","status":"published","published":"2026-09-17T08:21:35Z","modified":"2026-10-15T09:48:00.467342046Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"DRUPAL-CONTRIB-2025-101","description":"This module enables you to protect individual pages with a password.\n\nThe module doesn't limit the number of password attempts, making it vulnerable to brute force attacks.\n\nThis vulnerability is mitigated by the fact that an attacker must know the protected page's URL.\n\n**CVSS risk score ([experimental](https://www.drupal.org/project/securitydrupalorg/issues/3442181)) 6.3 / Medium**\n\n[CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)","status":"published","published":"2025-08-27T17:19:59Z","modified":"2026-09-10T03:45:15.679067841Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}