CVE-2023-5256CWE-200

Drupal core - Critical - Cache poisoning - SA-CORE-2023-006

High · published September 28, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
57.8
In the wild
Unconfirmed
What it is

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.

This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.

The core REST and contributed GraphQL modules are not affected.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00851 · 57.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-09-28T18:17Z
EPSS history
Timeline
  • 28 SEP 18:17Z
    Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
    cvelistv5