CVE-2022-25276 - CVE House
Back to Database
Status published Unknown CVE-2022-25276

The Media oEmbed iframe route does not properly validate the...

Vulnerability Description

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-25276

Credits & Attribution

No credits recorded in the NVD database.

References

More from Drupal

View All →
CVE-2025-9954
Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105
Unknown 0
CVE-2025-9554
Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104
Unknown 0
CVE-2025-9553
API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103
Unknown 0
CVE-2025-9552
Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102
Unknown 0
CVE-2025-9551
Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101
Unknown 0

Affected Vendor

Affected Software

Core
Vulnerable Versions:
9.4, 9.3

Timeline

Official Publish: April 26th, 2023
Last Modified: February 3rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.