CVE-2023-31250
2 advisories.
Packagist/drupal/core CVE-2023-31250: unknown
The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to.
Action: Upgrade drupal/core to 9.4.14 or later.
composer require drupal/core:9.4.14composer require drupal/core:9.5.8composer require drupal/core:10.0.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 9.4.14 | - |
| 9.5.0 | 9.5.8 | - |
| 10.0.0 | 10.0.8 | - |
Fixed versions
| 9.4.14 | 9.5.8 | 10.0.8 |
Sources
CVE-2023-31250 · published · modified · JSON
Packagist/drupal/core CVE-2023-31250: critical
Access bypass in Drupal core
Action: Upgrade drupal/core to 7.96 or later.
composer require drupal/core:10.0.8composer require drupal/core:9.5.8composer require drupal/core:9.4.14composer require drupal/core:7.96Affected
| introduced | fixed | last affected |
|---|---|---|
| 10.0.0 | 10.0.8 | - |
| 9.5.0 | 9.5.8 | - |
| 9.0.0 | 9.4.14 | - |
| 7.0.0 | 7.96 | - |
Fixed versions
| 10.0.8 | 9.5.8 | 9.4.14 | 7.96 |
Sources
- osv: GHSA-8849-cv9f-vccm
- https://nvd.nist.gov/vuln/detail/CVE-2023-31250
- https://github.com/drupal/core
- https://www.drupal.org/sa-core-2023-005
CVE-2023-31250 · published · modified · JSON