[Security-news] WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2025-030

Project: WEB-T [1]
Date: 2025-April-09
Security risk: *Moderately critical* 12 ∕ 25
AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass, Denial of service

Affected versions: <1.1.0
CVE IDs: CVE-2025-3475
Description: 
This module enables you to translate nodes, configuration, UI strings
automatically.

The module doesn't sufficiently validate the incoming API response when using
eTranslation integration, which has an asynchronous workflow. Specially
crafted requests could overwrite entities and translations of entities with
arbitrary content and create load on the system leading to a Denial of
Service.

Solution: 
Install the latest version:

  * If you use the WEB-T module with version < 1.1.0, upgrade to WEB-T 1.1.0
    [3]

Reported By: 
  * Jan Kellermann (jan kellermann) [4]

Fixed By: 
  * dragels [5]
  * Jan Kellermann (jan kellermann) [6]

Coordinated By: 
  * Greg Knaddison (greggles) [7] of the Drupal Security Team
  * Juraj Nemec (poker10) [8] of the Drupal Security Team


[1] https://www.drupal.org/project/webt
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/webt/releases/1.1.0
[4] https://www.drupal.org/u/jan-kellermann
[5] https://www.drupal.org/u/dragels
[6] https://www.drupal.org/u/jan-kellermann
[7] https://www.drupal.org/u/greggles
[8] https://www.drupal.org/u/poker10