Drupal Currency
CVE-2025-10930
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure authenticated admin to attacker page
-
ExploitDeliver forged cross-site request
-
ExecutionBrowser submits request with valid session
-
ImpactUnauthorized state change in Currency module
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a logged-in Drupal user (typically an administrator with Currency-management permissions) to be tricked into visiting attacker-controlled content or clicking a crafted link while their session is active (UI:R) - the module does not validate an anti-CSRF token on the affected state-changing request. Limiting factors: the attacker cannot act without a victim's authenticated session and must rely on social engineering to trigger the request; impact is confined to integrity (I:L) with no data disclosure or service disruption, and sites running Currency 3.5.0 or later are not affected. |
| Impact | This is a genuinely low-priority issue despite being a network-vector flaw. The CVSS 3.1 base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects a classic CSRF weakness (CWE-352): network-reachable and requiring no attacker privileges, but gated by user interaction (UI:R) and limited to low integrity impact with no confidentiality or availability loss. Every secondary signal agrees with the low rating: EPSS is only 0.13% (2nd percentile), there is no CISA KEV listing (no public exploit identified at time of analysis), and no POC is referenced. No signals conflict - the quantitative exploitation-probability data, the absence of active-exploitation evidence, and the modest CVSS impact all point the same direction. The affected software is a single Drupal contributed module (Currency, 2bits), not a core or ubiquitous platform, which further constrains real-world exposure. Treat this as routine patch-cycle hygiene rather than an emergency: no SSVC/automatable metadata was supplied, but the UI:R requirement makes automatable-at-scale exploitation unlikely. |
| Exploit ScenarioDerived | An attacker crafts a malicious web page or email link and lures an authenticated Drupal administrator into clicking it while logged in; the forged request then performs a state-changing action in the Currency module under the victim's session. No public exploit code is known, and successful exploitation depends on the victim being tricked into the interaction (UI:R), yielding only limited integrity impact. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Cross-site request forgery in the Drupal Currency contributed module (versions before 3.5.0) lets an attacker trigger state-changing requests through a victim's browser session, because the module fails to validate a per-request anti-CSRF token on that operation. As reflected in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), exploitation requires tricking a logged-in Drupal user - typically an administrator with Currency-management permissions - into visiting attacker-controlled content or clicking a crafted link while their session is active, and the resulting impact is limited to a low-integrity modification with no data disclosure or service disruption. No public exploit code has been identified and the issue is not in CISA KEV; EPSS is negligible at 0.13% (2nd percentile), making this a genuinely low-priority issue despite being a network-vector flaw, and sites already running Currency 3.5.0 or later are unaffected.
RemediationAI
Upgrade the Drupal Currency module to 3.5.0 or later - this is the vendor-released fix, documented in the Drupal security advisory at https://www.drupal.org/sa-contrib-2025-110, and should be applied through the site's normal update workflow (composer update drupal/currency or equivalent, followed by database updates as required) with the update validated on a staging copy before production rollout. Where an immediate upgrade is not possible, compensating controls are limited because the root cause is a missing in-module token check: restrict the Currency-management permissions (administer currency / currency configuration permissions) to a small, trusted set of accounts to shrink the set of sessions an attacker could exploit; enforce short session lifetimes and require re-authentication for administrative roles so that a dormant session is less likely to be live when a lure is clicked; deploy a reverse proxy with CSRF/Origin-header and Referer checks, or apply Drupal's same-site cookie settings (e.g., SameSite=Lax/Strict on the session cookie), understanding that SameSite cookie tightening is the most effective stopgap but can break legitimate cross-site integrations and embedded workflows; and make the module read-only by removing permissions from untrusted roles, accepting that this disables legitimate currency administration for those users. Because exploitation depends on social engineering, reinforcing phishing awareness for site administrators provides additional marginal risk reduction. No public exploit code was identified at the time of analysis, so prioritized emergency response is not warranted.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a Drupal contributed module (project 'Currency', maintained under the 2bits vendor namespace as captured by CPE cpe:2.3:a:2bits:currency:*:*:*:*:*:drupal:*:*) that provides currency data and management functionality within a Drupal site. The weakness class is CWE-352, Cross-Site Request Forgery: the module performs a state-changing operation without requiring a valid form token (Drupal's per-session, per-form anti-CSRF token generated by the Form API or a manually validated token), so a request forged from an external origin and replayed by the victim's browser is accepted as legitimate. Because the browser automatically attaches the victim's Drupal session cookie, authorization checks pass even though the request originated from the attacker, and the same-origin policy provides no protection against a top-level cross-site form POST or forged request. There is no server-side vulnerability in the underlying currency library itself; the exposure is entirely the missing request-authenticity check at the module's request-handling layer, which is why the CVSS vector scores integrity impact only (I:L) and requires user interaction (UI:R).
Know when Currency gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CSRF is network-delivered (AV:N) needing no attacker privileges (PR:N) but depends on a logged-in victim's action (UI:R), causing only limited integrity change (I:L) with no C/A impact.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
GitHub PoC
Exploit-DB