CVE-2025-13080 (GCVE-0-2025-13080)

Vulnerability from cvelistv5 – Published: 2025-11-18 16:54 – Updated: 2025-11-18 20:35
VLAI?
Summary
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • CWE-754 - Improper Check for Unusual or Exceptional Conditions
Assigner
References
Impacted products
Vendor Product Version
Drupal Drupal core Affected: 8.0.0 , < 10.4.9 (semver)
Affected: 10.5.0 , < 10.5.6 (semver)
Affected: 11.0.0 , < 11.1.9 (semver)
Affected: 11.2.0 , < 11.2.8 (semver)
Create a notification for this product.
Credits
Dragos Dumitrescu (dragos-dumi) yasser ALLAM (inzo_) Nils Destoop (nils.destoop) Sven Decabooter (svendecabooter) zhero Alex Pott (alexpott) catch (catch) cilefen (cilefen) Jen Lampton (jenlampton) Lee Rowlands (larowlan) Dave Long (longwave) Drew Webber (mcdruid) Nils Destoop (nils.destoop) Juraj Nemec (poker10) Ra Mänd (ram4nd) Jess (xjm) catch (catch) Greg Knaddison (greggles) Lee Rowlands (larowlan) Dave Long (longwave) Drew Webber (mcdruid) Juraj Nemec (poker10) Jess (xjm)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-13080",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-18T20:35:13.962818Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-18T20:35:16.717Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "defaultStatus": "unaffected",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.4.9",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.5.6",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.9",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.8",
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dragos Dumitrescu (dragos-dumi)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "yasser ALLAM (inzo_)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Nils Destoop (nils.destoop)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Sven Decabooter (svendecabooter)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "zhero"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alex Pott (alexpott)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "catch (catch)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jen Lampton (jenlampton)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nils Destoop (nils.destoop)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ra M\u00c3\u00a4nd (ram4nd)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jess  (xjm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "catch (catch)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2025-11-12T18:33:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.\u003cp\u003eThis issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.\u003c/p\u003e"
            }
          ],
          "value": "Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-18T16:54:32.042Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2025-005"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2025-13080",
    "datePublished": "2025-11-18T16:54:32.042Z",
    "dateReserved": "2025-11-12T18:26:35.916Z",
    "dateUpdated": "2025-11-18T20:35:16.717Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-13080\",\"sourceIdentifier\":\"mlhess@drupal.org\",\"published\":\"2025-11-18T17:15:58.813\",\"lastModified\":\"2025-11-24T17:43:22.410\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"mlhess@drupal.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-754\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"10.4.9\",\"matchCriteriaId\":\"187161BC-CF72-4A12-9DA7-637A024DD97A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.5.0\",\"versionEndExcluding\":\"10.5.6\",\"matchCriteriaId\":\"6637885B-CE3E-4FCE-9899-A21BA12F6C87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.0.0\",\"versionEndExcluding\":\"11.1.9\",\"matchCriteriaId\":\"A80C15FD-FB6B-4E22-B836-8A18842BEED0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.2.0\",\"versionEndExcluding\":\"11.2.8\",\"matchCriteriaId\":\"4D477FF8-4E52-43B9-8799-36DAEB8524E0\"}]}]}],\"references\":[{\"url\":\"https://www.drupal.org/sa-core-2025-005\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-13080\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-11-18T20:35:13.962818Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-11-18T20:35:10.538Z\"}}], \"cna\": {\"title\": \"Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Dragos Dumitrescu (dragos-dumi)\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"yasser ALLAM (inzo_)\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Nils Destoop (nils.destoop)\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Sven Decabooter (svendecabooter)\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"zhero\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Alex Pott (alexpott)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"catch (catch)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"cilefen  (cilefen)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Jen Lampton (jenlampton)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Lee Rowlands (larowlan)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Dave Long (longwave)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Drew Webber (mcdruid)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Nils Destoop (nils.destoop)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Juraj Nemec (poker10)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Ra M\\u00c3\\u00a4nd (ram4nd)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Jess  (xjm)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"catch (catch)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Greg Knaddison (greggles)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Lee Rowlands (larowlan)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Dave Long (longwave)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Drew Webber (mcdruid)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Juraj Nemec (poker10)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jess  (xjm)\"}], \"impacts\": [{\"capecId\": \"CAPEC-87\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-87 Forceful Browsing\"}]}], \"affected\": [{\"repo\": \"https://git.drupalcode.org/project/drupal\", \"vendor\": \"Drupal\", \"product\": \"Drupal core\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.0.0\", \"lessThan\": \"10.4.9\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"10.5.0\", \"lessThan\": \"10.5.6\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.0.0\", \"lessThan\": \"11.1.9\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.2.0\", \"lessThan\": \"11.2.8\", \"versionType\": \"semver\"}], \"collectionURL\": \"https://www.drupal.org/project/drupal\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-11-12T18:33:00.000Z\", \"references\": [{\"url\": \"https://www.drupal.org/sa-core-2025-005\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.\u003cp\u003eThis issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-754\", \"description\": \"CWE-754 Improper Check for Unusual or Exceptional Conditions\"}]}], \"providerMetadata\": {\"orgId\": \"2c85b837-eb8b-40ed-9d74-228c62987387\", \"shortName\": \"drupal\", \"dateUpdated\": \"2025-11-18T16:54:32.042Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-13080\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-18T20:35:16.717Z\", \"dateReserved\": \"2025-11-12T18:26:35.916Z\", \"assignerOrgId\": \"2c85b837-eb8b-40ed-9d74-228c62987387\", \"datePublished\": \"2025-11-18T16:54:32.042Z\", \"assignerShortName\": \"drupal\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.