CVE-2023-5256: Generation of Error Message Containing Sensitive Information

September 28, 2023 (updated October 5, 2023)

In certain scenarios, Drupal’s JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.

This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.

The core REST and contributed GraphQL modules are not affected.

References

github.com/advisories/GHSA-rjqg-3h9m-fx5x
nvd.nist.gov/vuln/detail/CVE-2023-5256
www.drupal.org/sa-core-2023-006

Code Behaviors & Features

Detect and mitigate CVE-2023-5256 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →