Project:
Date:
2025-April-23
Vulnerability:
Cross Site Request Forgery
Affected versions:
<4.3.9
CVE IDs:
CVE-2025-3907
Description:
This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module.
The module doesn't sufficiently protect certain routes from CSRF attacks.
This vulnerability is mitigated by the fact that a site admin would have to perform further steps after the attack for it to have any effect.
Solution:
Install the latest version:
- If you use the Search API Solr module for Drupal 8+, upgrade to Search API Solr 4.3.10.
We also recommend checking your Solr configuration for any unintended changes.
Reported By:
Coordinated By:
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
