DRUPAL-CORE-2023-006
The advisory, in context
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.
This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.
The core REST and contributed GraphQL modules are not affected.
Drupal Steward partners have been made aware of this issue. Some platforms may provide mitigations. However, not all WAF configurations can mitigate the issue, so it is still recommended to update promptly to this security release if your site uses JSON:API.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 8.7.0 before 9.5.11
Fixed in 9.5.11
From 10.0.0 before 10.0.11
Fixed in 10.0.11
From 10.1.0 before 10.1.4
Fixed in 10.1.4
203 explicitly affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9, 10.1.0, 10.1.1, 10.1.2, 10.1.3, 8.7.0, 8.7.1, 8.7.10, 8.7.11, 8.7.12, 8.7.13, 8.7.14, 8.7.2, 8.7.3, 8.7.4, 8.7.5, 8.7.6, 8.7.7, 8.7.8, 8.7.9, 8.8.0, 8.8.0-alpha1, 8.8.0-beta1, 8.8.0-rc1, 8.8.1, 8.8.10, 8.8.11, 8.8.12, 8.8.2, 8.8.3, 8.8.4, 8.8.5, 8.8.6, 8.8.7, 8.8.8, 8.8.9, 8.9.0, 8.9.0-beta1, 8.9.0-beta2, 8.9.0-beta3, 8.9.0-rc1, 8.9.1, 8.9.10, 8.9.11, 8.9.12, 8.9.13, 8.9.14, 8.9.15, 8.9.16, 8.9.17, 8.9.18, 8.9.19, 8.9.2, 8.9.20, 8.9.3, 8.9.4, 8.9.5, 8.9.6, 8.9.7, 8.9.8, 8.9.9, 9.0.0, 9.0.0-alpha1, 9.0.0-alpha2, 9.0.0-beta1, 9.0.0-beta2, 9.0.0-beta3, 9.0.0-rc1, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.1.0, 9.1.0-alpha1, 9.1.0-beta1, 9.1.0-rc1, 9.1.0-rc2, 9.1.0-rc3, 9.1.1, 9.1.10, 9.1.11, 9.1.12, 9.1.13, 9.1.14, 9.1.15, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.1.8, 9.1.9, 9.2.0, 9.2.0-alpha1, 9.2.0-beta1, 9.2.0-beta2, 9.2.0-beta3, 9.2.0-rc1, 9.2.1, 9.2.10, 9.2.11, 9.2.12, 9.2.13, 9.2.14, 9.2.15, 9.2.16, 9.2.17, 9.2.18, 9.2.19, 9.2.2, 9.2.20, 9.2.21, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8, 9.2.9, 9.3.0, 9.3.0-alpha1, 9.3.0-beta1, 9.3.0-beta2, 9.3.0-beta3, 9.3.0-rc1, 9.3.1, 9.3.10, 9.3.11, 9.3.12, 9.3.13, 9.3.14, 9.3.15, 9.3.16, 9.3.17, 9.3.18, 9.3.19, 9.3.2, 9.3.20, 9.3.21, 9.3.22, 9.3.3, 9.3.4, 9.3.5, 9.3.6, 9.3.7, 9.3.8, 9.3.9, 9.4.0, 9.4.0-alpha1, 9.4.0-beta1, 9.4.0-rc1, 9.4.0-rc2, 9.4.1, 9.4.10, 9.4.11, 9.4.12, 9.4.13, 9.4.14, 9.4.15, 9.4.2, 9.4.3, 9.4.4, 9.4.5, 9.4.6, 9.4.7, 9.4.8, 9.4.9, 9.5.0, 9.5.0-beta1, 9.5.0-beta2, 9.5.0-rc1, 9.5.0-rc2, 9.5.1, 9.5.10, 9.5.2, 9.5.3, 9.5.4, 9.5.5, 9.5.6, 9.5.7, 9.5.8, 9.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "8.7.0"
},
{
"fixed": "9.5.11"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">=8.7.0 <9.5.11"
}
},
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.11"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">=10.0 <10.0.11"
}
},
{
"events": [
{
"introduced": "10.1.0"
},
{
"fixed": "10.1.4"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">= 10.1 <10.1.4"
}
}
],
"versions": [
"10.0.0",
"10.0.1",
"10.0.10",
"10.0.2",
"10.0.3",
"10.0.4",
"10.0.5",
"10.0.6",
"10.0.7",
"10.0.8",
"10.0.9",
"10.1.0",
"10.1.1",
"10.1.2",
"10.1.3",
"8.7.0",
"8.7.1",
"8.7.10",
"8.7.11",
"8.7.12",
"8.7.13",
"8.7.14",
"8.7.2",
"8.7.3",
"8.7.4",
"8.7.5",
"8.7.6",
"8.7.7",
"8.7.8",
"8.7.9",
"8.8.0",
"8.8.0-alpha1",
"8.8.0-beta1",
"8.8.0-rc1",
"8.8.1",
"8.8.10",
"8.8.11",
"8.8.12",
"8.8.2",
"8.8.3",
"8.8.4",
"8.8.5",
"8.8.6",
"8.8.7",
"8.8.8",
"8.8.9",
"8.9.0",
"8.9.0-beta1",
"8.9.0-beta2",
"8.9.0-beta3",
"8.9.0-rc1",
"8.9.1",
"8.9.10",
"8.9.11",
"8.9.12",
"8.9.13",
"8.9.14",
"8.9.15",
"8.9.16",
"8.9.17",
"8.9.18",
"8.9.19",
"8.9.2",
"8.9.20",
"8.9.3",
"8.9.4",
"8.9.5",
"8.9.6",
"8.9.7",
"8.9.8",
"8.9.9",
"9.0.0",
"9.0.0-alpha1",
"9.0.0-alpha2",
"9.0.0-beta1",
"9.0.0-beta2",
"9.0.0-beta3",
"9.0.0-rc1",
"9.0.1",
"9.0.10",
"9.0.11",
"9.0.12",
"9.0.13",
"9.0.14",
"9.0.2",
"9.0.3",
"9.0.4",
"9.0.5",
"9.0.6",
"9.0.7",
"9.0.8",
"9.0.9",
"9.1.0",
"9.1.0-alpha1",
"9.1.0-beta1",
"9.1.0-rc1",
"9.1.0-rc2",
"9.1.0-rc3",
"9.1.1",
"9.1.10",
"9.1.11",
"9.1.12",
"9.1.13",
"9.1.14",
"9.1.15",
"9.1.2",
"9.1.3",
"9.1.4",
"9.1.5",
"9.1.6",
"9.1.7",
"9.1.8",
"9.1.9",
"9.2.0",
"9.2.0-alpha1",
"9.2.0-beta1",
"9.2.0-beta2",
"9.2.0-beta3",
"9.2.0-rc1",
"9.2.1",
"9.2.10",
"9.2.11",
"9.2.12",
"9.2.13",
"9.2.14",
"9.2.15",
"9.2.16",
"9.2.17",
"9.2.18",
"9.2.19",
"9.2.2",
"9.2.20",
"9.2.21",
"9.2.3",
"9.2.4",
"9.2.5",
"9.2.6",
"9.2.7",
"9.2.8",
"9.2.9",
"9.3.0",
"9.3.0-alpha1",
"9.3.0-beta1",
"9.3.0-beta2",
"9.3.0-beta3",
"9.3.0-rc1",
"9.3.1",
"9.3.10",
"9.3.11",
"9.3.12",
"9.3.13",
"9.3.14",
"9.3.15",
"9.3.16",
"9.3.17",
"9.3.18",
"9.3.19",
"9.3.2",
"9.3.20",
"9.3.21",
"9.3.22",
"9.3.3",
"9.3.4",
"9.3.5",
"9.3.6",
"9.3.7",
"9.3.8",
"9.3.9",
"9.4.0",
"9.4.0-alpha1",
"9.4.0-beta1",
"9.4.0-rc1",
"9.4.0-rc2",
"9.4.1",
"9.4.10",
"9.4.11",
"9.4.12",
"9.4.13",
"9.4.14",
"9.4.15",
"9.4.2",
"9.4.3",
"9.4.4",
"9.4.5",
"9.4.6",
"9.4.7",
"9.4.8",
"9.4.9",
"9.5.0",
"9.5.0-beta1",
"9.5.0-beta2",
"9.5.0-rc1",
"9.5.0-rc2",
"9.5.1",
"9.5.10",
"9.5.2",
"9.5.3",
"9.5.4",
"9.5.5",
"9.5.6",
"9.5.7",
"9.5.8",
"9.5.9"
]
}From 8.7.0 before 9.5.11
Fixed in 9.5.11
188 explicitly affected versions
8.7.0, 8.7.1, 8.7.10, 8.7.11, 8.7.12, 8.7.13, 8.7.14, 8.7.2, 8.7.3, 8.7.4, 8.7.5, 8.7.6, 8.7.7, 8.7.8, 8.7.9, 8.8.0, 8.8.0-alpha1, 8.8.0-beta1, 8.8.0-rc1, 8.8.1, 8.8.10, 8.8.11, 8.8.12, 8.8.2, 8.8.3, 8.8.4, 8.8.5, 8.8.6, 8.8.7, 8.8.8, 8.8.9, 8.9.0, 8.9.0-beta1, 8.9.0-beta2, 8.9.0-beta3, 8.9.0-rc1, 8.9.1, 8.9.10, 8.9.11, 8.9.12, 8.9.13, 8.9.14, 8.9.15, 8.9.16, 8.9.17, 8.9.18, 8.9.19, 8.9.2, 8.9.20, 8.9.3, 8.9.4, 8.9.5, 8.9.6, 8.9.7, 8.9.8, 8.9.9, 9.0.0, 9.0.0-alpha1, 9.0.0-alpha2, 9.0.0-beta1, 9.0.0-beta2, 9.0.0-beta3, 9.0.0-rc1, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.1.0, 9.1.0-alpha1, 9.1.0-beta1, 9.1.0-rc1, 9.1.0-rc2, 9.1.0-rc3, 9.1.1, 9.1.10, 9.1.11, 9.1.12, 9.1.13, 9.1.14, 9.1.15, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.1.8, 9.1.9, 9.2.0, 9.2.0-alpha1, 9.2.0-beta1, 9.2.0-beta2, 9.2.0-beta3, 9.2.0-rc1, 9.2.1, 9.2.10, 9.2.11, 9.2.12, 9.2.13, 9.2.14, 9.2.15, 9.2.16, 9.2.17, 9.2.18, 9.2.19, 9.2.2, 9.2.20, 9.2.21, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8, 9.2.9, 9.3.0, 9.3.0-alpha1, 9.3.0-beta1, 9.3.0-beta2, 9.3.0-beta3, 9.3.0-rc1, 9.3.1, 9.3.10, 9.3.11, 9.3.12, 9.3.13, 9.3.14, 9.3.15, 9.3.16, 9.3.17, 9.3.18, 9.3.19, 9.3.2, 9.3.20, 9.3.21, 9.3.22, 9.3.3, 9.3.4, 9.3.5, 9.3.6, 9.3.7, 9.3.8, 9.3.9, 9.4.0, 9.4.0-alpha1, 9.4.0-beta1, 9.4.0-rc1, 9.4.0-rc2, 9.4.1, 9.4.10, 9.4.11, 9.4.12, 9.4.13, 9.4.14, 9.4.15, 9.4.2, 9.4.3, 9.4.4, 9.4.5, 9.4.6, 9.4.7, 9.4.8, 9.4.9, 9.5.0, 9.5.0-beta1, 9.5.0-beta2, 9.5.0-rc1, 9.5.0-rc2, 9.5.1, 9.5.10, 9.5.2, 9.5.3, 9.5.4, 9.5.5, 9.5.6, 9.5.7, 9.5.8, 9.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "8.7.0"
},
{
"fixed": "9.5.11"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.7.0",
"8.7.1",
"8.7.10",
"8.7.11",
"8.7.12",
"8.7.13",
"8.7.14",
"8.7.2",
"8.7.3",
"8.7.4",
"8.7.5",
"8.7.6",
"8.7.7",
"8.7.8",
"8.7.9",
"8.8.0",
"8.8.0-alpha1",
"8.8.0-beta1",
"8.8.0-rc1",
"8.8.1",
"8.8.10",
"8.8.11",
"8.8.12",
"8.8.2",
"8.8.3",
"8.8.4",
"8.8.5",
"8.8.6",
"8.8.7",
"8.8.8",
"8.8.9",
"8.9.0",
"8.9.0-beta1",
"8.9.0-beta2",
"8.9.0-beta3",
"8.9.0-rc1",
"8.9.1",
"8.9.10",
"8.9.11",
"8.9.12",
"8.9.13",
"8.9.14",
"8.9.15",
"8.9.16",
"8.9.17",
"8.9.18",
"8.9.19",
"8.9.2",
"8.9.20",
"8.9.3",
"8.9.4",
"8.9.5",
"8.9.6",
"8.9.7",
"8.9.8",
"8.9.9",
"9.0.0",
"9.0.0-alpha1",
"9.0.0-alpha2",
"9.0.0-beta1",
"9.0.0-beta2",
"9.0.0-beta3",
"9.0.0-rc1",
"9.0.1",
"9.0.10",
"9.0.11",
"9.0.12",
"9.0.13",
"9.0.14",
"9.0.2",
"9.0.3",
"9.0.4",
"9.0.5",
"9.0.6",
"9.0.7",
"9.0.8",
"9.0.9",
"9.1.0",
"9.1.0-alpha1",
"9.1.0-beta1",
"9.1.0-rc1",
"9.1.0-rc2",
"9.1.0-rc3",
"9.1.1",
"9.1.10",
"9.1.11",
"9.1.12",
"9.1.13",
"9.1.14",
"9.1.15",
"9.1.2",
"9.1.3",
"9.1.4",
"9.1.5",
"9.1.6",
"9.1.7",
"9.1.8",
"9.1.9",
"9.2.0",
"9.2.0-alpha1",
"9.2.0-beta1",
"9.2.0-beta2",
"9.2.0-beta3",
"9.2.0-rc1",
"9.2.1",
"9.2.10",
"9.2.11",
"9.2.12",
"9.2.13",
"9.2.14",
"9.2.15",
"9.2.16",
"9.2.17",
"9.2.18",
"9.2.19",
"9.2.2",
"9.2.20",
"9.2.21",
"9.2.3",
"9.2.4",
"9.2.5",
"9.2.6",
"9.2.7",
"9.2.8",
"9.2.9",
"9.3.0",
"9.3.0-alpha1",
"9.3.0-beta1",
"9.3.0-beta2",
"9.3.0-beta3",
"9.3.0-rc1",
"9.3.1",
"9.3.10",
"9.3.11",
"9.3.12",
"9.3.13",
"9.3.14",
"9.3.15",
"9.3.16",
"9.3.17",
"9.3.18",
"9.3.19",
"9.3.2",
"9.3.20",
"9.3.21",
"9.3.22",
"9.3.3",
"9.3.4",
"9.3.5",
"9.3.6",
"9.3.7",
"9.3.8",
"9.3.9",
"9.4.0",
"9.4.0-alpha1",
"9.4.0-beta1",
"9.4.0-rc1",
"9.4.0-rc2",
"9.4.1",
"9.4.10",
"9.4.11",
"9.4.12",
"9.4.13",
"9.4.14",
"9.4.15",
"9.4.2",
"9.4.3",
"9.4.4",
"9.4.5",
"9.4.6",
"9.4.7",
"9.4.8",
"9.4.9",
"9.5.0",
"9.5.0-beta1",
"9.5.0-beta2",
"9.5.0-rc1",
"9.5.0-rc2",
"9.5.1",
"9.5.10",
"9.5.2",
"9.5.3",
"9.5.4",
"9.5.5",
"9.5.6",
"9.5.7",
"9.5.8",
"9.5.9"
]
}From 10.0.0 before 10.0.11
Fixed in 10.0.11
11 explicitly affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.11"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.0.0",
"10.0.1",
"10.0.10",
"10.0.2",
"10.0.3",
"10.0.4",
"10.0.5",
"10.0.6",
"10.0.7",
"10.0.8",
"10.0.9"
]
}From 10.1.0 before 10.1.4
Fixed in 10.1.4
4 explicitly affected versions
10.1.0, 10.1.1, 10.1.2, 10.1.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "10.1.0"
},
{
"fixed": "10.1.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.1.0",
"10.1.1",
"10.1.2",
"10.1.3"
]
}References
- https://www.drupal.org/sa-core-2023-006
- https://nvd.nist.gov/vuln/detail/CVE-2023-5256
- https://github.com/drupal/core/commit/1cd2741c2b43f6ad1bdfc121b8d9ec3b87e70742
- https://github.com/drupal/core/commit/5495dc530e3acd056478245bfe1828210c6da7dc
- https://github.com/drupal/core/commit/d4fe67562ee3ea0d9ecb9672d2945d94c5633d24
- https://github.com/drupal/core