Cyber Resilience

CVE-2025-31689

High

Published: 31 March 2025

Published
31 March 2025
Modified
02 September 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
EPSS Score 0.0043 62.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-31689 is a high-severity CSRF (CWE-352) vulnerability in General Data Protection Regulation Project General Data Protection Regulation. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 37.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-31689 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the Drupal General Data Protection Regulation module. Published on 2025-03-31, it affects all versions from 0.0.0 before 3.0.1 and from 3.1.0 before 3.1.2. The vulnerability enables CSRF attacks against sites using this module for GDPR compliance features.

With a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), the flaw is exploitable over the network with low complexity and no required privileges, though it demands user interaction such as visiting a malicious site. Any remote attacker can craft forged requests that, when processed on behalf of an authenticated user, result in high integrity and availability impacts, such as unauthorized modifications to GDPR data or service disruptions.

The Drupal security advisory SA-CONTRIB-2025-018 at https://www.drupal.org/sa-contrib-2025-018 provides details on mitigation, recommending upgrades to General Data Protection Regulation version 3.0.1 or 3.1.2, where the issue is addressed.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
attack.mitre.org →
Why these techniques?

CSRF vuln in public-facing Drupal module enables forged requests via malicious link/site visited by user (T1204.001), exploiting the web app for unauthorized actions (T1190).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-25121Shared CWE-352
CVE-2025-24001Shared CWE-352
CVE-2025-25147Shared CWE-352
CVE-2026-34904Shared CWE-352
CVE-2024-26153Shared CWE-352
CVE-2025-28860Shared CWE-352
CVE-2026-45430Shared CWE-352
CVE-2025-23880Shared CWE-352
CVE-2025-59541Shared CWE-352
CVE-2026-23622Shared CWE-352

Affected Assets

general data protection regulation project
general data protection regulation
≤ 3.0.1 · 3.1.0 — 3.1.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Timely flaw remediation directly mitigates the CSRF vulnerability by upgrading the Drupal GDPR module to patched versions 3.0.1 or 3.1.2 as recommended in the security advisory.

SC-23 Session Authenticity good match
prevent

Session authenticity mechanisms, such as anti-CSRF tokens, prevent forged requests from being processed on behalf of authenticated users exploiting this CSRF flaw.

SI-10 Information Input Validation partial match
prevent

Information input validation ensures proper checking of request parameters, including CSRF tokens, to block malicious forged requests targeting the GDPR module.

References