UpHeron
All vulnerabilities

Servers and applications

CVE-2022-25276

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Severity
Medium 6.1
Published
26 Apr 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.3.19, 9.4.3
Sources
NVD

Affected software

SoftwareAffected versions
DrupalServers and applications · cpe:a:drupal:drupal
  • From 9.3.0 before 9.3.19
  • From 9.4.0 before 9.4.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-25276
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-25276