7.5Hoch

CVE-2023-5256Drupal core - Critical - Cache poisoning - SA-CORE-2023-006

Drupal Core; drupal drupal Veröffentlicht: 2023-09-28 21:17 (vor 3 Jahren)

Beschreibung

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.

Schwachstellentyp (CWE): CWE-200

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
Drupal	Core	10.1 – ≤ 10.1.4, 10.0 – ≤ 10.0.11, 9.5 – ≤ 9.5.11
drupal	drupal	10.1 – < 10.1.4, 10.0 – < 10.0.11, 9.5 – < 9.5.11

Referenzen und Patches

https://www.drupal.org/sa-core-2023-006

CVSS-Score

7.5Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Hoch
Rechte erforderlich: Niedrig
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.85%

höher als 58 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2023-09-28
Veröffentlicht2023-09-28 21:17
Bei IP-DB eingegangen2026-10-24 23:52
Zuletzt aktualisiert2024-09-23 21:25

Vergeben von (CNA): drupal

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Drupal

8.1Hoch

CVE-2026-108097 vor 9 Tagen

Drupal core - Critical - Remote code execution - SA-CORE-2026-014

Drupal Drupal core

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10,…

6.5Mittel

CVE-2026-108515 vor 9 Tagen

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

Drupal Drupal core

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to …

6.5Mittel

CVE-2026-108514 vor 9 Tagen

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

Drupal Drupal core

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to…

4.2Mittel

CVE-2026-15916 vor 2 Monaten

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Drupal Drupal core

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

4.7Mittel

CVE-2026-15917 vor 2 Monaten

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Drupal Drupal core

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.

5.4Mittel

CVE-2026-55805 vor 2 Monaten

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

Drupal Drupal core

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0…