Drupal core - Critical - Cache poisoning - SA-CORE-2023-006 (Drupal Core)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.85 % · percentile 58 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- drupal
- NVD status
- Modified
Description
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- DRUPAL-CORE-2023-006 — In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and mad
- GHSA-rjqg-3h9m-fx5x — Cache poisoning in drupal/core
European references
- ENISA EUVD · EUVD-2023-2586
- GCVE · GCVE-0-2023-5256
Affected configurations (NVD CPE)
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.7.0 < 9.5.11cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 10.0.0 < 10.0.11cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 10.1.0 < 10.1.4
Affected products
| Product | Versions |
|---|---|
| Drupal · Core | affected 10.1 ≤ 10.1.4 ; affected 10.0 ≤ 10.0.11 ; affected 9.5 ≤ 9.5.11 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |