CVE-2022-25276

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami drupal

[{"type":"SEMVER","events":[{"introduced":"9.3.0"},{"fixed":"9.3.19"},{"introduced":"9.4.0"},{"fixed":"9.4.3"}]}]

参照URL

advisory nvd.nist.gov
advisory github.com
web drupal.org