« Volver al listado

CVE-2025-31689

Estado: AnalizadaAlta (8.1)—

Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingUser Account ManagementApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

General Data Protection Regulation Project — General Data Protection Regulation

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-31689",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-31689",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-29T15:25:01.765167Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "mlhess@drupal.org",
      "affectedData": [
        {
          "repo": "https://git.drupalcode.org/project/gdpr",
          "vendor": "Drupal",
          "product": "General Data Protection Regulation",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.0.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.1.0",
              "lessThan": "3.1.2",
              "versionType": "semver"
            }
          ],
          "collectionURL": "https://www.drupal.org/project/gdpr",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-31T22:15:21.517",
  "references": [
    {
      "url": "https://www.drupal.org/sa-contrib-2025-018",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mlhess@drupal.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de Cross-Site Request Forgery (CSRF) en Drupal General Data Protection Regulation permite Cross-Site Request Forgery. Este problema afecta al Reglamento General de Protección de Datos: desde la versión 0.0.0 hasta la 3.0.1, desde la versión 3.1.0 hasta la 3.1.2."
    }
  ],
  "lastModified": "2026-06-17T09:10:46.863",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:general_data_protection_regulation_project:general_data_protection_regulation:*:*:*:*:*:drupla:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44CB3408-6EC6-4C58-8811-2884ED5EF8F0",
              "versionEndExcluding": "3.0.1"
            },
            {
              "criteria": "cpe:2.3:a:general_data_protection_regulation_project:general_data_protection_regulation:*:*:*:*:*:drupla:*:*",
              "vulnerable": true,
              "matchCriteriaId": "468AF378-0FC1-4AE7-8B55-698711141247",
              "versionEndExcluding": "3.1.2",
              "versionStartIncluding": "3.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org"
}