Drupal core – Critical – Cache poisoning – SA-CORE-2023-006

29 de septiembre de 2023

Acabamos de recibir del CCN-CERT, esta noticia importante:

Project: Drupal coreDate: 2023-September-20Security risk: Critical 16∕25 AC:Complex/A:None/CI:All/II:Some/E:Theoretical/TD:DefaultVulnerability: Cache poisoningAffected versions: >=8.7.0 =10.0 = 10.1 CVE IDs: CVE-2023-5256Description: In certain scenarios, Drupals JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.This vulnerability only affects

More info:

https://www.drupal.org/sa-core-2023-006

Puedes encontrar mayores detalles en el enlace que sigue:

http://www.ccn-cert.cni.es/component/vulnerabilidades/view/34667.html