Drupal Matomo Analytics Cross-Site Request Forgery (CSRF) vulnerability

中危 6.8CVE-2025-31680 · DRUPAL-CONTRIB-2025-008 · GHSA-jh66-rjx8-8qqc · Published 31/03/2025 · updated 17/06/2026

要点

CVE-2025-31680 是影响 drupal/matomo, drupal/matomo, matomo analytics (matomo analytics project) 的中危 (CVSS 6.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.18%，高于 7.7% 的漏洞。
修复：升级到 1.24.0, 8.x-1.24 或更高版本。

Package	Affected versions	Patched versions
drupal/matomo Packagist	`< 1.24.0`	`1.24.0`
drupal/matomo Packagist:https://packages.drupal.org/8	`< 1.24.0`	`1.24.0`
matomo analytics matomo_analytics_project	`≥ 5.x-1.0, < 8.x-1.24`	`8.x-1.24`

Description

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery. This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.

NVD description

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.

References

nvd.nist.gov/vuln/detail/CVE-2025-31680 · ADVISORY
git.drupalcode.org/project/matomo · PACKAGE
drupal.org/sa-contrib-2025-008 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free