CVE-2025-31689
Published: 31 March 2025
Description
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Security Summary
CVE-2025-31689 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the Drupal General Data Protection Regulation module. Published on 2025-03-31, it affects all versions from 0.0.0 before 3.0.1 and from 3.1.0 before 3.1.2. The vulnerability enables CSRF attacks against sites using this module for GDPR compliance features.
With a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), the flaw is exploitable over the network with low complexity and no required privileges, though it demands user interaction such as visiting a malicious site. Any remote attacker can craft forged requests that, when processed on behalf of an authenticated user, result in high integrity and availability impacts, such as unauthorized modifications to GDPR data or service disruptions.
The Drupal security advisory SA-CONTRIB-2025-018 at https://www.drupal.org/sa-contrib-2025-018 provides details on mitigation, recommending upgrades to General Data Protection Regulation version 3.0.1 or 3.1.2, where the issue is addressed.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CSRF vuln in public-facing Drupal module enables forged requests via malicious link/site visited by user (T1204.001), exploiting the web app for unauthorized actions (T1190).