Improper Authentication Handling in Drupal Access Code by Drupal
CVE-2025-3129

4.8MEDIUM

Key Information:

Vendor
Drupal
Status
Access Code
Vendor
CVE Published:
2 April 2025

Summary

A vulnerability exists in the Access Code component of Drupal that allows an attacker to launch brute-force attacks due to improper handling of excessive authentication attempts. This exposure can lead to unauthorized access as the system fails to limit login attempts effectively. Users of Access Code prior to version 2.0.4 should take immediate steps to update their software to mitigate this security risk.

Affected Version(s)

Access code 0.0.0 < 2.0.4

References

https://www.drupal.org/sa-contrib-2025-028

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcin Maruszewski (marcin maruszewski)
Gergely Lekli (glekli)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
.