PT-2023-23267 · Drupal · Drupal

Publicado 2023-04-26 · Atualizado 2025-02-03 · CVE-2023-31250

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal (affected versions not specified)

Description The file download facility does not sufficiently sanitize file paths in certain situations, potentially allowing users to access private files they should not have access to. Some sites may require configuration changes following a security release. Users should review the release notes for their Drupal version if they encounter issues accessing private files after updating.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BIT-DRUPAL-2023-31250

CVE-2023-31250

DRUPAL-CORE-2023-005

GHSA-8849-CV9F-VCCM

Produtos afetados

Drupal

Referências · 11

• https://github.com/drupal/core · Nota
• https://drupal.org/sa-core-2023-005 · Aviso do Fabricante
• https://t.me/cvenotify/109701 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31250 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-drupal-2023-31250 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-31250 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-31250 · Aviso do Fabricante
• https://t.me/cibsecurity/62927 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-31250 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8849-cv9f-vccm · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-31250 · Aviso do Fabricante