PT-2023-23267 · Drupal · Drupal

Published 2023-04-26 · Updated 2025-02-03 · CVE-2023-31250

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal (affected versions not specified)

Description The file download facility does not sufficiently sanitize file paths in certain situations, potentially allowing users to access private files they should not have access to. Some sites may require configuration changes following a security release. Users should review the release notes for their Drupal version if they encounter issues accessing private files after updating.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-DRUPAL-2023-31250

CVE-2023-31250

DRUPAL-CORE-2023-005

GHSA-8849-CV9F-VCCM

Affected Products

Drupal

References · 11

• https://drupal.org/sa-core-2023-005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31250 · Security Note
• https://osv.dev/vulnerability/BIT-drupal-2023-31250 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-31250 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-31250 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31250 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8849-cv9f-vccm · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-31250 · Vendor Advisory
• https://github.com/drupal/core · Note
• https://t.me/cvenotify/109701 · Telegram Post
• https://t.me/cibsecurity/62927 · Telegram Post