Common Weakness Enumeration
CWE-962
Grouping ProhibitedSFP Secondary Cluster: Unchecked Status Condition
Status: Incomplete
This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).
Grouping entries organize the catalogue and should not be used to map the root cause of a vulnerability.
Mapping guidance
This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
See member weaknesses of this category.
Relationships and members
Content history
Submission: CWE Content Team
· MITRE
· 2014-07-29
· CWE 2.8
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Description
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Mapping_Notes, Type
1 vulnerability references this CWE, most recent first.
CVE-2025-8361 (GCVE-0-2025-8361)
Vulnerability from cvelistv5 – Published: 2025-08-15 16:26 – Updated: 2026-08-10 15:40
VLAI
EPSS
VEX
Title
Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093
Summary
Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.
This issue affects Config Pages: from 0.0.0 before 2.18.0.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-15 18:00 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Drupal | Config Pages |
Affected:
0.0.0 , < 2.18.0
(semver)
|
Date Public
2025-07-30 16:30
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-8361",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-15T18:00:34.376857Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-15T18:01:18.736Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/config_pages",
"defaultStatus": "unaffected",
"product": "Config Pages",
"repo": "https://git.drupalcode.org/project/config_pages",
"vendor": "Drupal",
"versions": [
{
"lessThan": "2.18.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pierre Rudloff (prudloff)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Pierre Rudloff (prudloff)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexander Shumenko (shumer)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Greg Knaddison (greggles)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Heine Deelstra (heine)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jess (xjm)"
}
],
"datePublic": "2025-07-30T16:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.\u003cp\u003eThis issue affects Config Pages: from 0.0.0 before 2.18.0.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.\n\nThis issue affects Config Pages: from 0.0.0 before 2.18.0."
}
],
"impacts": [
{
"capecId": "CAPEC-87",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-87 Forceful Browsing"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:40:48.866Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2025-093"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2025-8361",
"datePublished": "2025-08-15T16:26:46.012Z",
"dateReserved": "2025-07-30T16:03:41.028Z",
"dateUpdated": "2026-08-10T15:40:48.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.