CVE-2023-5256: Infoleak
First published: Thu Sep 28 2023(Updated: )
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.
Credit: mlhess@drupal.org mlhess@drupal.org mlhess@drupal.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Drupal Drupal | >=8.7.0<9.5.11 | |
| Drupal Drupal | >=10.0.0<10.0.11 | |
| Drupal Drupal | >=10.1.0<10.1.4 | |
| composer/drupal/core | >=10.1.0<10.1.4 | 10.1.4 |
| composer/drupal/core | >=10.0.0<10.0.11 | 10.0.11 |
| composer/drupal/core | >=8.7.0<9.5.11 | 9.5.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-5256
- https://www.drupal.org/sa-core-2023-006
- https://github.com/drupal/core/commit/1cd2741c2b43f6ad1bdfc121b8d9ec3b87e70742
- https://github.com/drupal/core/commit/5495dc530e3acd056478245bfe1828210c6da7dc
- https://github.com/drupal/core/commit/d4fe67562ee3ea0d9ecb9672d2945d94c5633d24
- https://github.com/advisories/GHSA-rjqg-3h9m-fx5x (Advisory)
Frequently Asked Questions
What is the vulnerability ID of this Drupal vulnerability?
The vulnerability ID of this Drupal vulnerability is CVE-2023-5256.
What is the severity of CVE-2023-5256?
The severity of CVE-2023-5256 is high.
Which Drupal module is affected by CVE-2023-5256?
The JSON:API module of Drupal is affected by CVE-2023-5256.
Which versions of Drupal are affected by CVE-2023-5256?
Drupal versions 8.7.0 to 9.5.11 and Drupal versions 10.0.0 to 10.0.11 are affected by CVE-2023-5256.
What is the risk of CVE-2023-5256?
CVE-2023-5256 may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/github-advisory
- alias/GHSA-rjqg-3h9m-fx5x
- alias/CVE-2023-5256
- collector/github-advisory-latest
- collector/nvd-api
- collector/nvd-cve
- collector/nvd-index
- package-manager/composer
- vendor/drupal
- canonical/drupal drupal
- version/drupal drupal/8.7.0
- version/drupal drupal/10.0.0
- version/drupal drupal/10.1.0