Headline
CVE-2023-5256: Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
In certain scenarios, Drupal’s JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.
This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.
The core REST and contributed GraphQL modules are not affected.
Affected versions:
>=8.7.0 <9.5.11 || >=10.0 <10.0.11 || >= 10.1 <10.1.4
Description:
In certain scenarios, Drupal’s JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.
This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.
The core REST and contributed GraphQL modules are not affected.
Drupal Steward partners have been made aware of this issue. Some platforms may provide mitigations. However, not all WAF configurations can mitigate the issue, so it is still recommended to update promptly to this security release if your site uses JSON:API.
Fixed By:
- Drew Webber of the Drupal Security Team
- Peter Wolanin of the Drupal Security Team
- Nathaniel Catchpole of the Drupal Security Team
- Alex Bronstein of the Drupal Security Team
- Lee Rowlands of the Drupal Security Team
- xjm of the Drupal Security Team
- Wim Leers
- Benji Fisher of the Drupal Security Team