CVE-2025-13083

published 2025-11-18

CVE-2025-13083: Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security…

Priority P4 16 low 3.7 CVSS 3.1

AV N AC H PR N UI N S U C L I N A N

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
drupal	core	>= 10.5.0 < 10.5.6	10.5.6
drupal	core	>= 11.0.0 < 11.1.9	11.1.9
drupal	core	>= 11.2.0 < 11.2.8	11.2.8
drupal	core	>= 7.0 < 7.103	7.103
drupal	core	>= 8.0.0 < 10.4.9	10.4.9
drupal	drupal	>= 10.5.0 < 10.5.6	10.5.6
drupal	drupal	>= 11.0.0 < 11.1.9	11.1.9
drupal	drupal	>= 11.2.0 < 11.2.8	11.2.8
drupal	drupal	>= 8.0.0 < 10.4.9	10.4.9
drupal	drupal_core	—	—
drupal	drupal_core	>= 10.5.0 < 10.5.6	10.5.6
drupal	drupal_core	>= 11.0.0 < 11.1.9	11.1.9
drupal	drupal_core	>= 11.2.0 < 11.2.8	11.2.8
drupal	drupal_core	7.0 – 7.103	—
drupal	drupal_core	>= 8.0.0 < 10.4.9	10.4.9

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-525