CVE-2025-10929 - Vulnerability Details - OpenCVE

Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Drupal	Drupal Reverse Proxy Header

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-111

History

Thu, 30 Oct 2025 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal drupal Drupal reverse Proxy Header
Vendors & Products		Drupal Drupal drupal Drupal reverse Proxy Header

Thu, 30 Oct 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 29 Oct 2025 23:30:00 +0000

Type	Values Removed	Values Added
Description		Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.
Title		Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111
Weaknesses		CWE-1288
References		https://www.drupal.org/sa-contrib-2025-111

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-10-29T23:14:07.047Z

Updated: 2025-10-30T13:31:48.665Z

Reserved: 2025-09-24T16:53:13.156Z

Link: CVE-2025-10929

Vulnrichment

Updated: 2025-10-30T13:31:02.737Z

NVD

Status : Awaiting Analysis

Published: 2025-10-30T00:15:34.187

Modified: 2025-10-30T15:03:13.440

Link: CVE-2025-10929

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10929", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-09-24T16:53:13.156Z", "datePublished": "2025-10-29T23:14:07.047Z", "dateUpdated": "2025-10-30T13:31:48.665Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/reverse_proxy_header", "defaultStatus": "unaffected", "product": "Reverse Proxy Header", "repo": "https://git.drupalcode.org/project/reverse_proxy_header", "vendor": "Drupal", "versions": [{"lessThan": "1.1.2", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "remediation developer", "value": "Bohdan Artemchuk (bohart)"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "remediation developer", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "coordinator", "value": "Pierre Rudloff (prudloff)"}], "datePublic": "2025-09-24T17:28:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.<p>This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.</p>"}], "value": "Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2."}], "impacts": [{"capecId": "CAPEC-77", "descriptions": [{"lang": "en", "value": "CAPEC-77 Manipulating User-Controlled Variables"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1288", "description": "CWE-1288 Improper Validation of Consistency within Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-10-29T23:14:07.047Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-111"}], "source": {"discovery": "UNKNOWN"}, "title": "Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111", "x_generator": {"engine": "Vulnogram 0.4.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-30T13:31:45.484329Z", "id": "CVE-2025-10929", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T13:31:48.665Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-10929", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T13:31:45.484329Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T13:31:02.737Z"}}], "cna": {"title": "Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "remediation developer", "value": "Bohdan Artemchuk (bohart)"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "remediation developer", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "coordinator", "value": "Pierre Rudloff (prudloff)"}], "impacts": [{"capecId": "CAPEC-77", "descriptions": [{"lang": "en", "value": "CAPEC-77 Manipulating User-Controlled Variables"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/reverse_proxy_header", "vendor": "Drupal", "product": "Reverse Proxy Header", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.1.2", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/reverse_proxy_header", "defaultStatus": "unaffected"}], "datePublic": "2025-09-24T17:28:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-111"}], "x_generator": {"engine": "Vulnogram 0.4.0"}, "descriptions": [{"lang": "en", "value": "Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.", "supportingMedia": [{"type": "text/html", "value": "Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.<p>This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1288", "description": "CWE-1288 Improper Validation of Consistency within Input"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-10-29T23:14:07.047Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10929", "state": "PUBLISHED", "dateUpdated": "2025-10-30T13:31:48.665Z", "dateReserved": "2025-09-24T16:53:13.156Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-10-29T23:14:07.047Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}