Project: 
WEB-T
Date: 
2025-April-09
Security risk: 
Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Access bypass, Denial of service
Affected versions: 
<1.1.0
CVE IDs: 
CVE-2025-3475
Description: 

This module enables you to translate nodes, configuration, UI strings automatically.

The module doesn't sufficiently validate the incoming API response when using eTranslation integration, which has an asynchronous workflow. Specially crafted requests could overwrite entities and translations of entities with arbitrary content and create load on the system leading to a Denial of Service.

Solution: 

Install the latest version:

  • If you use the WEB-T module with version < 1.1.0, upgrade to WEB-T 1.1.0
Reported By: 
Fixed By: 
Coordinated By: