Cyber Posture

CVE-2025-31689

High

Published: 31 March 2025

Published
31 March 2025
Modified
02 September 2025
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
EPSS Score 0.0013 31.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user clicking a malicious link in order to gain execution.

Security Summary

CVE-2025-31689 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the Drupal General Data Protection Regulation module. Published on 2025-03-31, it affects all versions from 0.0.0 before 3.0.1 and from 3.1.0 before 3.1.2. The vulnerability enables CSRF attacks against sites using this module for GDPR compliance features.

With a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), the flaw is exploitable over the network with low complexity and no required privileges, though it demands user interaction such as visiting a malicious site. Any remote attacker can craft forged requests that, when processed on behalf of an authenticated user, result in high integrity and availability impacts, such as unauthorized modifications to GDPR data or service disruptions.

The Drupal security advisory SA-CONTRIB-2025-018 at https://www.drupal.org/sa-contrib-2025-018 provides details on mitigation, recommending upgrades to General Data Protection Regulation version 3.0.1 or 3.1.2, where the issue is addressed.

Details

CWE(s)
CWE-352

Affected Products

general data protection regulation project
general data protection regulation
≤ 3.0.1 · 3.1.0 — 3.1.2

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Why these techniques?

CSRF vuln in public-facing Drupal module enables forged requests via malicious link/site visited by user (T1204.001), exploiting the web app for unauthorized actions (T1190).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References