CVE-2025-31686
Published: 31 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-31686 is a missing authorization vulnerability (CWE-862) in the Drupal Open Social distribution that allows forceful browsing. The issue affects Open Social versions from 0.0.0 before 12.3.11 and from 12.4.0 before 12.4.10.
Remote unauthenticated attackers with network access can exploit this vulnerability, which requires high attack complexity and no user interaction. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, as reflected in the CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
The Drupal security advisory at https://www.drupal.org/sa-contrib-2025-015 details the vulnerability. Sites should upgrade to Open Social 12.3.11 or 12.4.10, or later versions, to mitigate the issue.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Missing authorization vulnerability in public-facing Drupal Open Social distribution directly enables forceful browsing by remote unauthenticated attackers, mapping to exploitation of public-facing web applications.