CVE-2023-5256
Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
HIGH 7.5
En bref
- Source
- NVD
- EPSS
- EPSS 0.85 % · centile 58 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- drupal
- Statut NVD
- Modified
Description
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Avis
- DRUPAL-CORE-2023-006 — In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and mad
- GHSA-rjqg-3h9m-fx5x — Cache poisoning in drupal/core
Références européennes
- ENISA EUVD · EUVD-2023-2586
- GCVE · GCVE-0-2023-5256
Configurations affectées (CPE NVD)
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.7.0 < 9.5.11cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 10.0.0 < 10.0.11cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 10.1.0 < 10.1.4
Produits affectés
| Produit | Versions |
|---|---|
| Drupal · Core | affected 10.1 ≤ 10.1.4 ; affected 10.0 ≤ 10.0.11 ; affected 9.5 ≤ 9.5.11 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |