CVE-2023-5256
published 2023-09-28CVE-2023-5256: In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and…
PriorityP341high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
0.69%
48.3th percentile
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.
This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.
The core REST and contributed GraphQL modules are not affected.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| drupal | core | 10.0 – 10.0.11 | — |
| drupal | core | >= 10.0.0 < 10.0.11 | 10.0.11 |
| drupal | core | 10.1 – 10.1.4 | — |
| drupal | core | >= 10.1.0 < 10.1.4 | 10.1.4 |
| drupal | core | >= 8.7.0 < 9.5.11 | 9.5.11 |
| drupal | core | 9.5 – 9.5.11 | — |
| drupal | drupal | >= 10.0.0 < 10.0.11 | 10.0.11 |
| drupal | drupal | >= 10.1.0 < 10.1.4 | 10.1.4 |
| drupal | drupal | >= 8.7.0 < 9.5.11 | 9.5.11 |
| drupal | drupal_core | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-5256: In certain scenarios, Drupal's JSON:API module will output error backtraces
osv·2023-09-28·CVSS 7.5
CVE-2023-5256 [HIGH] CVE-2023-5256: In certain scenarios, Drupal's JSON:API module will output error backtraces
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.
GHSA
Cache poisoning in drupal/core
ghsa·2023-09-28
CVE-2023-5256 [CRITICAL] CWE-200 Cache poisoning in drupal/core
Cache poisoning in drupal/core
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.
This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.
The core REST and contributed GraphQL modules are not affected.
OSV
Cache poisoning in drupal/core
osv·2023-09-28
CVE-2023-5256 [CRITICAL] Cache poisoning in drupal/core
Cache poisoning in drupal/core
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.
This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.
The core REST and contributed GraphQL modules are not affected.
OSV
CVE-2023-5256: In certain scenarios, Drupal's JSON:API module will output error backtraces
osv·2023-09-20
CVE-2023-5256 CVE-2023-5256: In certain scenarios, Drupal's JSON:API module will output error backtraces
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.
This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.
The core REST and contributed GraphQL modules are not affected.
[Drupal Steward](/steward) partners have been made aware of this issue. Some platforms may provide mitigations. However, not all WAF configurations can mitigate the issue, so it is still recommended to update promptly to this security release if your site uses JSON:API.
Drupal
Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
vendor_drupal·2023-09-20
CVE-2023-5256 [HIGH] Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
Title: Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
Vulnerability Type: Cache poisoning
Description: In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected. Drupal Steward partners have been made aware of this issue. Some platforms may provide mitigations. However, not all WAF configurations can mitigate the issue, so it is still recommended to update promptly to this security release if your site uses JSON:API.
Solution: Inst
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-09-28
Published