CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
25.5%
In certain scenarios, Drupal’s JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected. Drupal Steward partners have been made aware of this issue. Some platforms may provide mitigations. However, not all WAF configurations can mitigate the issue, so it is still recommended to update promptly to this security release if your site uses JSON:API.
www.drupal.org/project/drupal/releases/10.0.11
www.drupal.org/project/drupal/releases/10.1.4
www.drupal.org/project/drupal/releases/9.5.11
www.drupal.org/psa-2021-06-29
www.drupal.org/user/255969
www.drupal.org/user/35733
www.drupal.org/user/3778490
www.drupal.org/user/395439
www.drupal.org/user/49851
www.drupal.org/user/65776
www.drupal.org/user/683300
www.drupal.org/user/78040
www.drupal.org/user/99777