PT-2025-47347 · Drupal · Drupal

Benji Fisher + 12 · Published 2025-11-18 · Updated 2025-11-25 · CVE-2025-13083

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 8.0.0 through 10.4.9 Drupal versions 10.5.0 through 10.5.6 Drupal versions 11.0.0 through 11.1.9 Drupal versions 11.2.0 through 11.2.8

Description A flaw exists in Drupal core related to the use of a web browser cache that can contain sensitive information. This is due to incorrectly configured access control security levels.

Recommendations Update Drupal core to version 10.4.9 or later. Update Drupal core to version 10.5.6 or later. Update Drupal core to version 11.1.9 or later. Update Drupal core to version 11.2.8 or later.

Fix

Weakness Enumeration

CWE-525

Related Identifiers

BIT-DRUPAL-2025-13083

CVE-2025-13083

DRUPAL-CORE-2025-008

GHSA-MHPG-HPJ5-73R2

Affected Products

Drupal

References · 8

• https://osv.dev/vulnerability/CVE-2025-13083 · Vendor Advisory
• https://drupal.org/sa-core-2025-008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13083 · Security Note
• https://osv.dev/vulnerability/BIT-drupal-2025-13083 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mhpg-hpj5-73r2 · Vendor Advisory
• https://github.com/drupal/core · Note
• https://twitter.com/CVEnew/status/1991042980942061651 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1990923129707778171 · Twitter Post