GitHub Advisoryadvisory · Packagist
GHSA-rjqg-3h9m-fx5x Cache poisoning in drupal/core
CRITICAL
Official page ↗
- Aliases
- CVE-2023-5256
- Ecosystem
- Packagist
- Packages
- drupal/core
- Severity
- Critical
- Weaknesses
- CWE-200
- Reviewed
- 2023-12-20
Affected packages
• Packagist drupal/core: >= 8.7.0, < 9.5.11 → fixed in 9.5.11
• Packagist drupal/core: >= 10.0.0, < 10.0.11 → fixed in 10.0.11
• Packagist drupal/core: >= 10.1.0, < 10.1.4 → fixed in 10.1.4
Description
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.
This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.
The core REST and contributed GraphQL modules are not affected.
Related
Alias · CVE (1)
- CVE-2023-5256 In certain scenarios, Drupal's JSON:API module will output error backtraces. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-5256 advisory
- https://github.com/drupal/core/commit/1cd2741c2b43f6ad1bdfc121b8d9ec3b87e70742 web
- https://github.com/drupal/core/commit/5495dc530e3acd056478245bfe1828210c6da7dc web
- https://github.com/drupal/core/commit/d4fe67562ee3ea0d9ecb9672d2945d94c5633d24 web
- https://github.com/drupal/core package
- https://www.drupal.org/sa-core-2023-006 web