Drupal Google Tag Cross-Site Request Forgery (CSRF)

中危 6.8CVE-2025-31683 · DRUPAL-CONTRIB-2025-012 · GHSA-qchr-8m24-7v66 · Published 31/03/2025 · updated 17/06/2026

要点

CVE-2025-31683 是影响 drupal/google_tag, drupal/google_tag, google tag (google tag project) 的中危 (CVSS 6.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.18%，高于 7.7% 的漏洞。
修复：升级到 2.0.8, 1.8.0, 8.x-1.8 或更高版本。

Package	Affected versions	Patched versions
drupal/google_tag Packagist	`≥ 2.0.0, < 2.0.8< 1.8.0`	`2.0.81.8.0`
drupal/google_tag Packagist:https://packages.drupal.org/8	`≥ 2.0.0, < 2.0.8< 1.8.0`	`2.0.81.8.0`
google tag google_tag_project	`≥ 2.0.0, < 2.0.8≥ 7.x-1.0, < 8.x-1.8`	`2.0.88.x-1.8`

Description

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery. This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

NVD description

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

References

nvd.nist.gov/vuln/detail/CVE-2025-31683 · ADVISORY
git.drupalcode.org/project/google_tag · PACKAGE
drupal.org/sa-contrib-2025-012 · WEB

drupal/google_tag 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

drupal/google_tag

Packagist

≥ 2.0.0, < 2.0.8< 1.8.0

2.0.81.8.0

drupal/google_tag

Packagist:https://packages.drupal.org/8

≥ 2.0.0, < 2.0.8< 1.8.0

2.0.81.8.0

google tag

google_tag_project

≥ 2.0.0, < 2.0.8≥ 7.x-1.0, < 8.x-1.8

2.0.88.x-1.8

Description

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery. This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

NVD description

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.