csaf_certbund - wid-sec-w-2023-2410

wid-sec-w-2023-2410

Vulnerability from csaf_certbund

Published

2023-09-20 22:00

Modified

2023-10-05 22:00

Summary

Drupal: Schwachstelle ermöglicht Offenlegung von Informationen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Drupal ausnutzen, um Informationen offenzulegen.

Betroffene Betriebssysteme

- Linux - MacOS X - Windows - Sonstiges

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Drupal ausnutzen, um Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Windows\n- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2410 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2410.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2410 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2410"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory vom 2023-09-20",
        "url": "https://www.drupal.org/sa-core-2023-006"
      }
    ],
    "source_lang": "en-US",
    "title": "Drupal: Schwachstelle erm\u00f6glicht Offenlegung von Informationen",
    "tracking": {
      "current_release_date": "2023-10-05T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:58:42.280+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-2410",
      "initial_release_date": "2023-09-20T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-09-20T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-10-05T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE erg\u00e4nzt"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Open Source Drupal \u003c 10.1.4",
                "product": {
                  "name": "Open Source Drupal \u003c 10.1.4",
                  "product_id": "T030002",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:10.1.4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Open Source Drupal \u003c 10.0.11",
                "product": {
                  "name": "Open Source Drupal \u003c 10.0.11",
                  "product_id": "T030003",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:10.0.11"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Open Source Drupal \u003c 9.5.11",
                "product": {
                  "name": "Open Source Drupal \u003c 9.5.11",
                  "product_id": "T030004",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:9.5.11"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Drupal"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-5256",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Drupal. Dieser Fehler besteht im JSON:API-Modul, das bei einigen Konfigurationen vertrauliche Informationen zwischenspeichert, was zu einem m\u00f6glichen Cache-Poisoning f\u00fchrt. Ein entfernter Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu eskalieren."
        }
      ],
      "release_date": "2023-09-20T22:00:00.000+00:00",
      "title": "CVE-2023-5256"
    }
  ]
}

cve-2023-5256

Vulnerability from cvelistv5

Published

2023-09-28 18:17

Modified

2024-09-23 18:25

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.

References

▼	URL	Tags
	https://www.drupal.org/sa-core-2023-006

Impacted products

Vendor

Product

Version

▼

Drupal

Core

Version: 10.1   ≤ 10.1.4
Version: 10.0   ≤ 10.0.11
Version: 9.5   ≤ 9.5.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:52:08.530Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.drupal.org/sa-core-2023-006"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "drupal",
            "vendor": "drupal",
            "versions": [
              {
                "lessThan": "10.1.4",
                "status": "affected",
                "version": "10.1",
                "versionType": "semver"
              },
              {
                "lessThan": "10.0.11",
                "status": "affected",
                "version": "10.0",
                "versionType": "semver"
              },
              {
                "lessThan": "9.5.11",
                "status": "affected",
                "version": "9.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-5256",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-23T18:22:43.682965Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-23T18:25:29.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Core",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThanOrEqual": "10.1.4",
              "status": "affected",
              "version": "10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.0.11",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.5.11",
              "status": "affected",
              "version": "9.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-09-21T18:17:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn certain scenarios, Drupal\u0027s JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.\u003c/p\u003e\u003cp\u003eThis vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.\u003c/p\u003e\u003cp\u003eThe core REST and contributed GraphQL modules are not affected.\u003c/p\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "In certain scenarios, Drupal\u0027s JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.\n\nThis vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.\n\nThe core REST and contributed GraphQL modules are not affected.\n\n\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-141",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-141 Cache Poisoning"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-28T18:17:43.128Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2023-006"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Drupal core - Critical - Cache poisoning - SA-CORE-2023-006",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2023-5256",
    "datePublished": "2023-09-28T18:17:43.128Z",
    "dateReserved": "2023-09-28T18:13:12.881Z",
    "dateUpdated": "2024-09-23T18:25:29.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted