Drupal core - Critical - Cache poisoning - SA-CORE-2023-006

CVE-2023-5256
7.5HIGH

Key Information

Vendor
Drupal
Status
Core
Vendor
CVE Published:
28 September 2023

Summary

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.

Affected Version(s)

Core <= 10.1.4

Core <= 10.0.11

Core <= 9.5.11

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved.

  • Vulnerability published.

Collectors

NVD DatabaseMitre Database
.