CVE-2025-13083CWE-525

CVE-2025-13083

Low · published November 18, 2025

CVSS v3.1
3.7
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.2th percentile
Weakness
CWE-525 · Use of Web Browser Cache Containing Sensitive Information
Published
2025-11-18T22:15Z
Affected products (4)
ProductVersionsFixed in
drupal/drupal≥ 8.0.0, < 10.4.910.4.9
drupal/drupal≥ 10.5.0, < 10.5.610.5.6
drupal/drupal≥ 11.0.0, < 11.1.911.1.9
drupal/drupal≥ 11.2.0, < 11.2.811.2.8
References (1)
https://www.drupal.org/sa-core-2025-008 · [email protected]
EPSS history
Timeline
  • 18 NOV 16:55Z
    Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008
    cvelistv5