Synchronize composer.json CVE-2025-9552
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Drupal site with vulnerable module
-
ExploitSend crafted unauthenticated HTTP request
-
ExecutionTrigger improper exposure of composer/module data
-
ImpactRead disclosed dependency metadata
Vulnerability Assessment
| Exploitation Conditions | Requires that the target Drupal site have the 'Synchronize composer.json With Contrib Modules' contrib module installed and enabled; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration is otherwise needed, so a reachable instance running this module is exploitable remotely. Limiting factors: the module is niche and not part of Drupal core (so most Drupal sites are unaffected), and impact is confined to limited confidentiality disclosure (C:L) with no integrity or availability effect, bounding the realistic harm to information leakage/reconnaissance. |
| Impact | All exploitation signals point to a low-priority, information-disclosure-only issue despite the unauthenticated network vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3 MEDIUM) describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction, but impact is confined to limited confidentiality (C:L) with no integrity or availability consequence - consistent with the 'Information Disclosure' tag. EPSS is 0.25% (15th percentile), indicating very low predicted exploitation probability; there is no CISA KEV listing and no public exploit identified at time of analysis. The combination of unauthenticated access but trivial-only confidentiality impact (likely exposure of composer.json/dependency metadata rather than secrets) makes this a genuine low-real-risk issue rather than a CVSS-inflated priority. CWE is unassigned (N/A) and the Drupal advisory (sa-contrib-2025-102) carries no severity escalation signals; the affected version range is published only as '*.*' with no explicit fixed version in the provided data - verify the patched release directly in the Drupal advisory. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends an HTTP request to a Drupal site running the 'Synchronize composer.json With Contrib Modules' module and retrieves module/dependency metadata that should not be publicly exposed. No public exploit code is identified, and the disclosed data (C:L) is limited rather than high-value, so practical value to an attacker is primarily reconnaissance (enumerating installed contrib modules and versions to plan follow-on attacks). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Unauthenticated information disclosure in the Drupal contrib module 'Synchronize composer.json With Contrib Modules' allows a remote attacker to read limited sensitive data from any Drupal site where this module is installed and enabled (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Only the confidentiality of the site is affected - there is no integrity or availability impact, no privilege escalation, and no user interaction required; the module is niche developer tooling rather than Drupal core, so the vast majority of Drupal installations are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and EPSS rates the likelihood of exploitation in the next 30 days at 0.25% (15th percentile), consistent with a low-priority reconnaissance-grade leak rather than an urgent, wormable issue.
RemediationAI
No exact fix version is specified in the available data; the authoritative source is the Drupal Security Team advisory SA-CONTRIB-2025-102 (https://www.drupal.org/sa-contrib-2025-102), where the corrected module release is published, so site maintainers should update the 'Synchronize composer.json With Contrib Modules' project to the version listed there and then run the Drupal database update if prompted. The module is a niche developer convenience tool that is not required by Drupal core, so the most definitive mitigation is to uninstall it entirely if it is not actively needed - that removes the vulnerable code path rather than merely patching it, at the cost of losing automated composer.json/manifest synchronization, which must then be maintained manually (or via Composer/Drush workflows). If the module must stay installed and no fixed release is immediately available, disable it in the Extends/Modules administration page so its routes are deregistered, and as a compensating control restrict or block network access to the affected module routes at the reverse proxy/WAF (or restrict the site to trusted IP ranges when it is a staging/development instance) - noting that such rules can break legitimate administrative or CI tooling that relies on the module and require tuning whenever paths change. Finally, because the exposure is read-only reconnaissance data, treat unexpected requests to the module's endpoints as an information-gathering signal and review Drupal access logs for anomalous unauthenticated hits.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a Drupal contrib module that keeps a site's composer.json manifest synchronized with the contrib modules actually installed/enabled on the site - a developer/DevOps convenience tool rather than end-user functionality. Drupal contrib modules register their own routes and controllers under /modules/contrib and register menu/permission entries; when those access callbacks or permission requirements are incomplete, an unauthenticated visitor can reach functionality or data that should be gated. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) shows a network-reachable endpoint with no authentication, no interaction, and no scope change, exposing only limited information - typically composer.json contents, installed-module inventory, or version metadata useful for reconnaissance. NVD supplied no CWE for this record, so the precise root-cause class is not formally mapped; the 'Information Disclosure' tag and the low-confidentiality impact are consistent with classes such as improper authorization checks on a route (CWE-862) or exposure of sensitive information (CWE-200), but this is an inferred characterization, not a vendor-confirmed mapping. The CPE cpe:2.3:a:synchronize_composer.json_with_contrib_modules_project:synchronize_composer.json_with_contrib_modules:*:*:*:*:*:drupal:*:* confirms the target platform is the generic Drupal application and that every released version of the module ('*') is in scope.
Know when Synchronize Composer Json With Contrib Modules gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated remote reachability (AV:N/AC:L/PR:N/UI:N) with only limited confidentiality disclosure (C:L) and no integrity or availability impact, matching the information-disclosure nature.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
DescriptionCVE.org
Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.*.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB