Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows
    Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from
    8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from
    7.0 before 7.103. (CVE-2025-13083)

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

- Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden.

- Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site.

- By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement.

- The core system module handles downloads of private and temporary files.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 8.x, 9.x, or 10.4.x prior to 10.4.9, 10.5.x prior to 10.5.6, 11.1.x prior to 11.1.9, or 11.2.x prior to 11.2.8. It is, therefore, affected by multiple vulnerabilities.

  - Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability     exists on the site. This so-called gadget chain presents no direct threat, but is a vector that can be     used to achieve remote code execution if the application deserializes untrusted data due to another     vulnerability. It is not directly exploitable. This issue is mitigated by the fact that in order for it to     be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to     unserialize(). There are no such known exploits in Drupal core. (CVE-2025-13081)

  - The core system module handles downloads of private and temporary files. Contrib modules can define     additional kinds of files (schemes) that may also be handled by the system module. In some cases, files     may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to     some users getting cached versions of files with information they should not be able to access. For     example, files may be cached by Varnish or a CDN. This vulnerability is mitigated by the following: Drupal     must be configured to handle non-public files using a custom or contributed module providing an additional     file scheme. An attacker must know to request a file that has previously been requested by a more-     privileged user, and that file must still be cached. (CVE-2025-13083)

  - By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement.
    The defacement is not stored and is only present when the URL has been crafted for that purpose. Only the     defacement is present, so no other site content (such as branding) is rendered. (CVE-2025-13082)

  - Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes     of incoming HTTP requests to be overridden. This functionality can be abused in a way that may cause     Drupal to cache response data that it should not. This can lead to legitimate requests receiving     inappropriate cached responses (cache poisoning). This could be exploited in various ways: Broken     rendering of some pages Unstyled or malformatted pages Adverse impacts on client-side functionality     Changes are being made in the underlying library which will mitigate this problem, but in the meantime     Drupal core has been hardened to protect against this vulnerability. (CVE-2025-13080)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
436103	SCA: security update for drupal/core (GHSA-mhpg-hpj5-73r2)	Tenable Cloud Security	SCA Checks	Local	medium
436103	SCA: security update for drupal/core (GHSA-mhpg-hpj5-73r2)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
115036	Drupal 8.0.x < 10.4.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115035	Drupal 10.5.x < 10.5.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115034	Drupal 11.0.x < 11.1.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115033	Drupal 11.2.x < 11.2.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
275249	Drupal 8.x/9.x/10.x < 10.4.9 / 10.5.x < 10.5.6 / 11.1.x < 11.1.9 / 11.2.x < 11.2.8 Multiple Vulnerabilities (drupal-2025-11-12)	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2025-13083

medium

Tenable Plugins

medium

medium

high

high

high

high

critical