CVE-2023-5256

    Dashboard / Vulnerabilities / CVE-2023-5256

    CVE-2023-5256

    Published: 28 Sept 2023Last Modified: 12 Aug 2026

    Summary: Drupal core - Critical - Cache poisoning - SA-CORE-2023-006

    Details: In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.

    References: https://www.drupal.org/sa-core-2023-006, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5256.json, https://nvd.nist.gov/vuln/detail/CVE-2023-5256

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 17ba30046ed57677de4feff8d07354890b40efdb
    Fixed -4576b6a4f1ac7e94a7547f226892a01999026cf2

    Affected versions

    10.0.10
    10.0.9
    10.0.7
    10.0.6
    10.0.4
    10.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-5256 | CVE-DB