Data Exposure Vulnerability in Drupal Profile Private by Drupal
CVE-2025-3059

5.3MEDIUM

Key Information:

Vendor
Drupal
Status
Profile Private
Vendor
CVE Published:
31 March 2025

Summary

A data exposure vulnerability has been identified in the Profile Private module for Drupal, which could potentially allow unauthorized access to private user profile information. This issue arises from improper handling of user data, making it susceptible to exploitation. It is crucial for Drupal users utilizing this module to review their configurations and apply recommended updates to safeguard sensitive user information.

Affected Version(s)

Profile Private *.*

References

https://www.drupal.org/sa-contrib-2025-002

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dezső Biczó
Ivo Van Geertruyen
Cathy Theys
Greg Knaddison
.