CVE-2023-5256
2 advisories.
Packagist/drupal/core CVE-2023-5256: unknown
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading
Action: Upgrade drupal/core to 9.5.11 or later.
composer require drupal/core:9.5.11composer require drupal/core:10.0.11composer require drupal/core:10.1.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.7.0 | 9.5.11 | - |
| 10.0.0 | 10.0.11 | - |
| 10.1.0 | 10.1.4 | - |
Fixed versions
| 9.5.11 | 10.0.11 | 10.1.4 |
Sources
CVE-2023-5256 · published · modified · JSON
Packagist/drupal/core CVE-2023-5256: critical
Cache poisoning in drupal/core
Action: Upgrade drupal/core to 9.5.11 or later.
composer require drupal/core:9.5.11composer require drupal/core:10.0.11composer require drupal/core:10.1.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.7.0 | 9.5.11 | - |
| 10.0.0 | 10.0.11 | - |
| 10.1.0 | 10.1.4 | - |
Fixed versions
| 9.5.11 | 10.0.11 | 10.1.4 |
Sources
- osv: GHSA-rjqg-3h9m-fx5x
- https://nvd.nist.gov/vuln/detail/CVE-2023-5256
- https://github.com/drupal/core/commit/1cd2741c2b43f6ad1bdfc121b8d9ec3b87e70742
- https://github.com/drupal/core/commit/5495dc530e3acd056478245bfe1828210c6da7dc
- https://github.com/drupal/core/commit/d4fe67562ee3ea0d9ecb9672d2945d94c5633d24
- https://github.com/drupal/core
- https://www.drupal.org/sa-core-2023-006
CVE-2023-5256 · published · modified · JSON