Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2022-016

{
  "id": "0fe5d3f55fb5bc981eceb1dd83ced8b4e9e2c765ca820bcccecba4f33450f5f4",
  "url": "https://www.drupal.org/sa-core-2022-016",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2022-016",
    "summary": "Drupal core updates its Twig integration to mitigate vulnerabilities involving untrusted users who can write Twig code. Exploitation may enable unauthorized access to private files, other server files, or database credentials; Drupal exploitation requires restricted administrative access.",
    "evidence": "Drupal core's code extending Twig has also been updated to mitigate a related vulnerability.",
    "products": [
      {
        "name": {
          "value": "Drupal core",
          "evidence": "Project: Drupal core"
        },
        "prerequisites": [
          {
            "value": "an untrusted user has access to write Twig code",
            "evidence": "Multiple vulnerabilities are possible if an untrusted user has access to write Twig code"
          },
          {
            "value": "a restricted access administrative permission",
            "evidence": "an exploit is only possible in Drupal core with a restricted access administrative permission"
          }
        ],
        "fixed_versions": [
          {
            "value": "9.4.7",
            "evidence": "If you are using Drupal 9.4, update to Drupal 9.4.7."
          },
          {
            "value": "9.3.22",
            "evidence": "If you are using Drupal 9.3, update to Drupal 9.3.22."
          }
        ],
        "affected_versions": [
          {
            "value": ">= 8.0.0 <9.3.22 || >= 9.4.0 <9.4.7",
            "evidence": "Affected versions: >= 8.0.0 <9.3.22 || >= 9.4.0 <9.4.7"
          }
        ]
      },
      {
        "name": {
          "value": "Twig",
          "evidence": "Drupal uses the Twig third-party library for content templating and sanitization."
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2022-39261",
        "evidence": "CVE IDs: CVE-2022-39261"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "Security risk: Critical"
  },
  "source_id": "official-drupal-security",
  "document_id": 23491,
  "published_at": "2022-09-28T16:24:08+00:00"
}