Cache poisoning in drupal/core
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-5256US | high7.5 | — | ||
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anony… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/drupal/corePACKAGE
- https://github.com/drupal/core/commit/1cd2741c2b43f6ad1bdfc121b8d9ec3b87e70742WEB
- https://github.com/drupal/core/commit/5495dc530e3acd056478245bfe1828210c6da7dcWEB
- https://github.com/drupal/core/commit/d4fe67562ee3ea0d9ecb9672d2945d94c5633d24WEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-5256ADVISORY
- https://www.drupal.org/sa-core-2023-006WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan