CVE-2022-25270

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Feb 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-252717.5Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation CVE-2022-252737.5Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation CVE-2022-252745.4Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permi CVE-2022-252757.5In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when g CVE-2022-252766.1The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of th CVE-2022-252777.2Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots fro CVE-2022-252786.5Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter CVE-2022-25286.5In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing p CVE-2022-25297.5sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malfor CVE-2022-252906.5WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private k CVE-2022-252918.8An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow CVE-2022-252928.8A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execut