CVE-2022-25273: 
PHP vulnerability analysis and mitigation

Drupal core's form API has a vulnerability (CVE-2022-25273) where certain contributed or custom modules' forms may be vulnerable to improper input validation. This vulnerability was disclosed in April 2023 and affects Drupal versions from 8.0.0 up to (excluding) 9.2.18 and versions from 9.3.0 up to (excluding) 9.3.12 (NVD).

The vulnerability exists in Drupal core's form API implementation, allowing attackers to potentially inject disallowed values or overwrite data. The severity is rated as HIGH with a CVSS v3.1 base score of 7.5, with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The vulnerability is classified under CWE-20 (Improper Input Validation) (NVD).

The vulnerability could allow an attacker to alter critical or sensitive data through form manipulation. While affected forms are described as uncommon, the potential impact is significant as it could lead to unauthorized data modification in systems where vulnerable forms are present (NVD).

The vulnerability was addressed in Drupal versions 9.2.18 and 9.3.12. Organizations running affected versions should upgrade to these patched versions or later to mitigate the risk (NVD).