[IT-SecNots] [Security-news] Acquia Content Hub - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-125

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2025-125

Project: Acquia Content Hub [1]
Date: 2025-December-10
Security risk: *Moderately critical* 11 ∕ 25
AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Cross-Site Request Forgery

Affected versions: <3.6.4 || >=3.7.0 <3.7.3 || >=3.8.0 <3.8.0
CVE IDs: CVE-2025-14472
Description: 
This module provides a centralized content distribution and syndication
solution so thta customers can publish, reuse, and syndicate content across a
network of Drupal websites.

The module doesn't sufficiently protect export routes from cross-site request
forgery (CSRF) attacks, potentially allowing an attacker to trick an admin
into exporting an unwanted entity.

Solution: 
Install the latest version:

 * If you use Acquia Content Hub 3.6.x, upgrade to Acquia Content Hub 3.6.4
   [3].
 * If you use Acquia Content Hub 3.7.x, upgrade to Acquia Content Hub 3.7.3
   [4].
 * The latest version, Acquia Content Hub 3.8.0 [5], is also now available
   with both the security fix and other improvements.

Reported By: 
 * Lee Rowlands (larowlan) [6] of the Drupal Security Team

Fixed By: 
 * Kirti Garg (kirti_garg) [7]
 * Narendra Shenvi Desai (n4r3n) [8]
 * Peter Pajor (pajor) [9]

Coordinated By: 
 * Greg Knaddison (greggles) [10] of the Drupal Security Team
 * Juraj Nemec (poker10) [11] of the Drupal Security Team
 * Jess  (xjm) [12] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [13]

[1] https://www.drupal.org/project/acquia_contenthub
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/acquia_contenthub/releases/3.6.4
[4] https://www.drupal.org/project/acquia_contenthub/releases/3.7.3
[5] https://www.drupal.org/project/acquia_contenthub/releases/3.8.0
[6] https://www.drupal.org/u/larowlan
[7] https://www.drupal.org/u/kirti_garg
[8] https://www.drupal.org/u/n4r3n
[9] https://www.drupal.org/u/pajor
[10] https://www.drupal.org/u/greggles
[11] https://www.drupal.org/u/poker10
[12] https://www.drupal.org/u/xjm
[13]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3562493

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news