-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions improper domain validation in the Media oEmbed iframe route. The OEmbedController::renderIframe method is the primary handler for oEmbed iframe rendering in Drupal's Media module. Before the patched versions, this controller did not implement proper domain validation checks when generating iframe content, allowing arbitrary domains to be embedded. This matches the CWE-79 (XSS) pattern of improper input validation during content generation. The confidence is high as this is the canonical oEmbed iframe handler and the vulnerability directly relates to its domain validation logic.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/core | composer | >= 8.0.0, < 9.3.19 | 9.3.19 |
| drupal/core | composer | >= 9.4.0, < 9.4.3 | 9.4.3 |
Ongoing coverage of React2Shell