CVEvulnerability

CVE-2023-5256

7.5 HIGH Published 2023-09-28 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-09-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200

Description

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.

Affected configurations

• drupal drupal (>= 8.7.0 < 9.5.11) • drupal drupal (>= 10.0.0 < 10.0.11) • drupal drupal (>= 10.1.0 < 10.1.4)

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References