csaf_certbund - wid-sec-w-2023-2410

WID-SEC-W-2023-2410

Vulnerability from csaf_certbund - Published: 2023-09-20 22:00 - Updated: 2023-10-05 22:00

Summary

Drupal: Schwachstelle ermöglicht Offenlegung von Informationen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Drupal ausnutzen, um Informationen offenzulegen.

Betroffene Betriebssysteme

- Linux - MacOS X - Windows - Sonstiges

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Drupal ausnutzen, um Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Windows\n- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2410 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2410.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2410 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2410"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory vom 2023-09-20",
        "url": "https://www.drupal.org/sa-core-2023-006"
      }
    ],
    "source_lang": "en-US",
    "title": "Drupal: Schwachstelle erm\u00f6glicht Offenlegung von Informationen",
    "tracking": {
      "current_release_date": "2023-10-05T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:58:42.280+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-2410",
      "initial_release_date": "2023-09-20T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-09-20T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-10-05T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE erg\u00e4nzt"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Open Source Drupal \u003c 10.1.4",
                "product": {
                  "name": "Open Source Drupal \u003c 10.1.4",
                  "product_id": "T030002",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:10.1.4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Open Source Drupal \u003c 10.0.11",
                "product": {
                  "name": "Open Source Drupal \u003c 10.0.11",
                  "product_id": "T030003",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:10.0.11"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Open Source Drupal \u003c 9.5.11",
                "product": {
                  "name": "Open Source Drupal \u003c 9.5.11",
                  "product_id": "T030004",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:9.5.11"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Drupal"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-5256",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Drupal. Dieser Fehler besteht im JSON:API-Modul, das bei einigen Konfigurationen vertrauliche Informationen zwischenspeichert, was zu einem m\u00f6glichen Cache-Poisoning f\u00fchrt. Ein entfernter Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu eskalieren."
        }
      ],
      "release_date": "2023-09-20T22:00:00.000+00:00",
      "title": "CVE-2023-5256"
    }
  ]
}

CVE-2023-5256 (GCVE-0-2023-5256)

Vulnerability from cvelistv5 – Published: 2023-09-28 18:17 – Updated: 2024-09-23 18:25

Title

Drupal core - Critical - Cache poisoning - SA-CORE-2023-006

Summary

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

drupal

References

URL

Tags

https://www.drupal.org/sa-core-2023-006

Impacted products

	Vendor	Product	Version
	Drupal	Core	Affected: 10.1 , ≤ 10.1.4 (semver) Affected: 10.0 , ≤ 10.0.11 (semver) Affected: 9.5 , ≤ 9.5.11 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:52:08.530Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.drupal.org/sa-core-2023-006"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "drupal",
            "vendor": "drupal",
            "versions": [
              {
                "lessThan": "10.1.4",
                "status": "affected",
                "version": "10.1",
                "versionType": "semver"
              },
              {
                "lessThan": "10.0.11",
                "status": "affected",
                "version": "10.0",
                "versionType": "semver"
              },
              {
                "lessThan": "9.5.11",
                "status": "affected",
                "version": "9.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-5256",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-23T18:22:43.682965Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-23T18:25:29.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Core",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThanOrEqual": "10.1.4",
              "status": "affected",
              "version": "10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.0.11",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.5.11",
              "status": "affected",
              "version": "9.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-09-21T18:17:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn certain scenarios, Drupal\u0027s JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.\u003c/p\u003e\u003cp\u003eThis vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.\u003c/p\u003e\u003cp\u003eThe core REST and contributed GraphQL modules are not affected.\u003c/p\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "In certain scenarios, Drupal\u0027s JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.\n\nThis vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.\n\nThe core REST and contributed GraphQL modules are not affected.\n\n\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-141",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-141 Cache Poisoning"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-28T18:17:43.128Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2023-006"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Drupal core - Critical - Cache poisoning - SA-CORE-2023-006",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2023-5256",
    "datePublished": "2023-09-28T18:17:43.128Z",
    "dateReserved": "2023-09-28T18:13:12.881Z",
    "dateUpdated": "2024-09-23T18:25:29.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2023-2410

CVE-2023-5256 (GCVE-0-2023-5256)

Tags

Sightings

Nomenclature