For the exploit discussed in:
[D7ES] Backport SA-CONTRIB-2025-051 for D7
https://security.drupal.org/node/183583

I've attached an update to the existing CVE.

Specific changes:
• updated the description to include new versions.
• updated version specifications to:

>=7.x-1.0 <=7.x-1.5
>=8.x-1.0 <=8.x-1.2
>=2.0.0 <2.0.5

• Added the reference to our vulnerability database entry
• Did not find an entry in the Tag1 database

Happy to change it if I've missed anything.

CommentFileSizeAuthor
CVE-2025-47705-iframeremove.txt6.01 KBaangel

Comments

aangel created an issue. See original summary.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Needs review

This LGTM.

aangel’s picture

aangel commented
Issue summary: View changes
greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Needs review » Fixed

There were some changes to the orgId in the json you provided that I didn't expect. So, I tried to manually make the changes you proposed rather than using the file as attached here.

I also used 1.0 and 1.2 for the 8.x version since I think that's how they are interpreted.

Now published and I'd appreciate your review, but consider this fixed.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

aangel’s picture

aangel commented

For the 8.x version, that works for me. I followed the actual version structure for this module (https://www.drupal.org/project/iframeremove/releases/8.x-1.2) but the 8.x ecosystem was a mix of version styles and I think if we just go with real semver for 8 up as a convention, that's just fine.

We could chase down why Bálint's name doesn't appear properly given that accents are common:
Bálint Nagy (nagy.balint)

It appears to have happened during input (rather than a display issue at cve.org) since the json shows ""value":"Bálint Nagy (nagy.balint)"},"

I didn't see other notable differences.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

Thanks for noticing that. I fixed Bálint Nagy (nagy.balint)'s name on the CVE just now.

For 8.x-1.2 versions, I believe they show as 8.x-1.2 in the drupal.org website, but then 1.2 in the perspective of composer. Notice how the command on that release page to install 8.x-1.2 with composer is composer require 'drupal/iframeremove:^1.2'

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.