CVE-2022-25278: 
PHP vulnerability analysis and mitigation

The vulnerability CVE-2022-25278 affects Drupal core form API, where under certain circumstances, it evaluates form element access incorrectly. This vulnerability was disclosed in July 2022 and affects Drupal Core versions 9.4.x prior to 9.4.3 and versions prior to 9.3.19. While no forms provided by Drupal core are known to be vulnerable, forms added through contributed or custom modules or themes may be affected (NVD Database).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. This indicates that the vulnerability is network accessible, requires low attack complexity, needs low privileges, requires no user interaction, and has a high impact on integrity but no impact on confidentiality or availability (NVD Database).

The vulnerability may lead to a user being able to alter data they should not have access to. This could potentially allow attackers to modify sensitive information through forms that are added by contributed or custom modules or themes (NVD Database).

The vulnerability has been patched in Drupal Core versions 9.4.3 and 9.3.19. Organizations using affected versions should upgrade to these patched versions to mitigate the risk. Versions of Drupal prior to 9.3 are considered obsolete and no longer receive security updates (CERT-FR).