CVE-2023-31250
Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005
概要
Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
drupal
[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.96.0"},{"introduced":"9.4.0"},{"fixed":"9.4.14"},{"introduced":"9.5.0"},{"fixed":"9.5.8"},{"introduced":"10.0.0"},{"fixed":"10.0.8"}]}]
参照URL
- advisory nvd.nist.gov
- advisory github.com
- web drupal.org