CVE-2023-5256

2023-09-2819:15:10

CWE-200

[email protected]

web.nvd.nist.gov

2410

drupal

json:api

error backtraces

sensitive information

privilege escalation

security vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.4%

JSON

In certain scenarios, Drupal’s JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.

This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.

The core REST and contributed GraphQL modules are not affected.

Affected configurations

NVD

Node

drupaldrupalRange8.7.0–9.5.11

drupaldrupalRange10.0.0–10.0.11

drupaldrupalRange10.1.0–10.1.4

CPENameOperatorVersion
drupal:drupaldrupallt9.5.11
drupal:drupaldrupallt10.0.11
drupal:drupaldrupallt10.1.4

CPE	Name	Operator	Version
drupal:drupal	drupal	lt	9.5.11
drupal:drupal	drupal	lt	10.0.11
drupal:drupal	drupal	lt	10.1.4

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Core",
    "vendor": "Drupal",
    "versions": [
      {
        "lessThanOrEqual": "10.1.4",
        "status": "affected",
        "version": "10.1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.0.11",
        "status": "affected",
        "version": "10.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.5.11",
        "status": "affected",
        "version": "9.5",
        "versionType": "semver"
      }
    ]
  }
]