CVE-2025-31675 currently describes the Link module in Drupal core. This request is to add Drupal 7 to the entry.

Please find attached a new json that has the following changes:
• The description now includes D7
• Note there I don't see a CVSS assessment at https://www.cve.org/CVERecord?id=CVE-2025-31675
• It could be tricky to make a CVSS assessment work for both branches so, because it's not currently there, I didn't add it (a user-contributed module issue vs a core issue)
• Changed the project to "https://www.drupal.org/project/link" instead of Drupal (but this might not work; it's tricky to make one entry work for both uses)
• Adds the third-party links for HeroDevs and Tag1

CommentFileSizeAuthor
#5 CVE-2025-31675-link-4.txt7.43 KBaangel
CVE-2025-31675-link.txt7.81 KBaangel

Comments

aangel created an issue. See original summary.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Needs review

Thanks! I think the project should stay as core, but we can update the description to link to the D7 project page.

Seems fine to leave CVSS out.

aangel’s picture

aangel commented

"I think the project should stay as core, but we can update the description to link to the D7 project page."

Might not be necessary. What I did was actually add a second product (which I didn't know you could do until I clicked the button). Product 1 is modern Drupal, product 2 is D7.

1. The first product continues to use core and all details are for modern Drupal.
2. The second product uses for https://www.drupal.org/project/link and https://git.drupalcode.org/project/link and version #'s are for D7.
3. The description is in common so I added the version #'s for D7 but that's it.

With this setup, I think it's clear to the reader where to find links for each distinct product...all because they allow multiple products.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Needs review » Needs work

That seems good. I tried to diff this against the current CVE but it seems quite different so I'm hesitant to just post this. Can you take a look at that? Maybe post a diff with your original cve?

aangel’s picture

aangel commented
StatusFileSize
new CVE-2025-31675-link-4.txt7.43 KB

Sorry about that. There were a few extraneous changes (metadata, stripped date stamp and the orgId—not sure how that bit happened) that I restored in this new version. This should apply cleanly. Here is a diff:

--- original_diff.json
+++ link_diff.json
@@ -84,6 +84,21 @@
               "versionType": "semver"
             }
           ]
+        },
+        {
+          "collectionURL": "https://www.drupal.org/project/link",
+          "defaultStatus": "unaffected",
+          "product": "Link",
+          "repo": "https://git.drupalcode.org/project/link",
+          "vendor": "Drupal",
+          "versions": [
+            {
+              "lessThanOrEqual": "7.x-1.12",
+              "status": "affected",
+              "version": "7.x-1.0",
+              "versionType": "custom"
+            }
+          ]
         }
       ],
       "credits": [
@@ -156,10 +171,10 @@
             {
               "base64": false,
               "type": "text/html",
-              "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).<p>This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5.</p>"
+              "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).<p>This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.</p>"
             }
           ],
-          "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5."
+          "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12."
         }
       ],
       "impacts": [
@@ -192,7 +207,22 @@
       },
       "references": [
         {
+          "tags": [
+            "vendor-advisory"
+          ],
           "url": "https://www.drupal.org/sa-core-2025-004"
+        },
+        {
+          "tags": [
+            "third-party-advisory"
+          ],
+          "url": "https://www.herodevs.com/vulnerability-directory/cve-2025-31675"
+        },
+        {
+          "tags": [
+            "third-party-advisory"
+          ],
+          "url": "https://d7es.tag1.com/security-advisories/link-moderately-critical-cross-site-scripting-sa-core-2025-004"
         }
       ],
       "source": {
greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Needs work » Fixed

Now published!

Thanks.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.