CVE-2025-31674
Drupal 8.0.0 – 10.3.13
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-31674 is a high-severity Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) vulnerability in Drupal Drupal. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Reflective Code Loading (T1620); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-31674 is an Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability, also described as enabling object injection, that affects Drupal core. The issue impacts versions from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, and from 11.1.0 before 11.1.3, and carries a CVSS 3.1 score of 7.5.
An authenticated attacker with low privileges can supply crafted input over the network to modify object attributes, achieving high impact on confidentiality, integrity, and availability. The attack requires some complexity but no user interaction.
The official advisory at https://www.drupal.org/sa-core-2025-003 addresses the flaw and directs administrators to apply the listed patches that bring installations to 10.3.13, 10.4.3, 11.0.12, or 11.1.3 or later.
EPSS for the CVE rose from a low baseline to a recorded peak of 0.0104, indicating emerging exploitation interest after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9049
Vulnerability Data
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Enforces authorizations so that only permitted attributes may be modified on an object.
Limits the set of modifiable attributes a subject is authorized to touch.
Validates incoming attribute names and values so that only explicitly allowed fields are accepted for update.
Isolating security functions from non-security code prevents unintended manipulation of dynamically managed executable resources.
Process isolation keeps each process's dynamic code resources in separate domains, blocking cross-process tampering.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly include controls that prevent improper handling of dynamic code resources.
Blocking unauthorized code execution directly limits the ability to abuse dynamically-managed resources.
Runtime-environment monitoring can detect exploitation of the weakness but does not prevent it.
Vulnerability identification can surface instances of CWE-913 but does not mitigate the root weakness.
Hardened configuration baselines can restrict dynamic code execution and variable access at runtime.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards explicitly forbid unsafe dynamic attribute assignment and require property allow-lists.
Security testing can detect mass-assignment flaws but does not itself prevent them at runtime.
Secure development lifecycle requires input validation and object-property whitelisting that directly mitigates mass-assignment risks.
Application security requirements include explicit rules for allowable object attributes and safe deserialization.
Secure architecture principles mandate strict control over dynamic object modification and attribute binding.
Information access restriction limits who can modify objects but does not address which attributes may be changed.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Windows 10 (1 rule)
- V-220726 Data Execution Prevention (DEP) must be configured to at least OptOut. prevents CWE-913
Windows 11 (1 rule)
- V-253283 Data Execution Prevention (DEP) must be configured to at least OptOut. prevents CWE-913