View online: https://www.drupal.org/sa-contrib-2025-030

Project: WEB-T [1] Date: 2025-April-09 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass, Denial of service

Affected versions: <1.1.0 CVE IDs: CVE-2025-3475 Description:  This module enables you to translate nodes, configuration, UI strings automatically.

The module doesn't sufficiently validate the incoming API response when using eTranslation integration, which has an asynchronous workflow. Specially crafted requests could overwrite entities and translations of entities with arbitrary content and create load on the system leading to a Denial of Service.

Solution:  Install the latest version:

* If you use the WEB-T module with version < 1.1.0, upgrade to WEB-T 1.1.0 [3]

Reported By:  * Jan Kellermann (jan kellermann) [4]

Fixed By:  * dragels [5] * Jan Kellermann (jan kellermann) [6]

Coordinated By:  * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team

[1] https://www.drupal.org/project/webt [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webt/releases/1.1.0 [4] https://www.drupal.org/u/jan-kellermann [5] https://www.drupal.org/u/dragels [6] https://www.drupal.org/u/jan-kellermann [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10