CSRF Vulnerability in Drupal AI Affects Security of User Data
CVE-2025-31677

8.8HIGH

Key Information:

Vendor
Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
31 March 2025

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal AI, enabling attackers to perform unauthorized actions on behalf of authenticated users without their knowledge. This issue affects versions 1.0.0 through 1.0.1, potentially compromising user accounts and data. Administrators are encouraged to update to the latest version to safeguard against such unauthorized actions.

Affected Version(s)

AI (Artificial Intelligence) 1.0.0 < 1.0.2

References

https://www.drupal.org/sa-contrib-2025-003

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson
Marcus Johansson
Michal Gow
Kevin Quillen
Andrew Belcher
Greg Knaddison
Drew Webber
Juraj Nemec
.