CVE-2025-13982
BaseFortify
Publication date: 2026-01-28
Last updated on: 2026-02-19
Assigner: Drupal.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| innoraft | login_time_restriction | to 1.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Drupal Login Time Restriction module. It allows an attacker to perform unauthorized actions on behalf of an authenticated user by exploiting the lack of proper CSRF protections in versions before 1.0.3.
How can this vulnerability impact me? :
An attacker could exploit this vulnerability to perform unauthorized actions within the Drupal Login Time Restriction module, potentially bypassing login time restrictions or manipulating login settings without the user's consent, leading to unauthorized access or changes.