GHSA-rjqg-3h9m-fx5x
Cache poisoning in drupal/core
At a glance
- Published
- Updated
- CVE
- CVE-2023-5256
- Aliases
- BIT-drupal-2023-5256, DRUPAL-CORE-2023-006
Description
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.
Affected packages
| Package | Versions |
|---|---|
| Packagist · drupal/core | introduced 8.7.0, fixed 9.5.11 |
| Packagist · drupal/core | introduced 10.0.0, fixed 10.0.11 |
| Packagist · drupal/core | introduced 10.1.0, fixed 10.1.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-5256 ADVISORY
- https://github.com/drupal/core/commit/1cd2741c2b43f6ad1bdfc121b8d9ec3b87e70742 WEB
- https://github.com/drupal/core/commit/5495dc530e3acd056478245bfe1828210c6da7dc WEB
- https://github.com/drupal/core/commit/d4fe67562ee3ea0d9ecb9672d2945d94c5633d24 WEB
- https://github.com/drupal/core PACKAGE
- https://www.drupal.org/sa-core-2023-006 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |