Vulnerability · Published Apr 26, 2023 · Assigned by drupal
CVE-2023-31250Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005
Medium 6.5
In plain English
A medium-severity incorrect authorization in Core from Drupal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | drupal/core | 10.0.8, 9.4.14, 9.5.8 | DRUPAL-CORE-2023-005 |
| Packagist | drupal/core | 10.0.8 | GHSA-8849-cv9f-vccm |
| Packagist | drupal/core | 9.5.8 | GHSA-8849-cv9f-vccm |
| Packagist | drupal/core | 9.4.14 | GHSA-8849-cv9f-vccm |
| Packagist | drupal/core | 7.96 | GHSA-8849-cv9f-vccm |
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N