CVE-2025-3131: ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-09 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2.*.

Affected products

Drupal Eca:Event - Condition - Action: before 1.1.12; from 2.0.0 before 2.0.16; from 2.1.0 before 2.1.7 — fixed in 1.1.12, 2.0.16, 2.1.7

How to fix

Upgrade to a fixed version: Drupal Eca:Event - Condition - Action 1.1.12, 2.0.16, 2.1.7. Check the vendor advisory for mitigations.

References

https://www.drupal.org/sa-contrib-2025-031

Get alerted when CVE-2025-3131 or the next vulnerability affects your stack