SynopsisA PHP application running on the remote web server is affected by a vulnerability.
DescriptionAccording to its self-reported version, the instance of Drupal running on the remote web server is 9.5.x prior to 9.5.11, 10.x prior to 10.0.11, or 10.1.x prior to 10.1.4. It is, therefore, affected by a vulnerability.
- In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected. Drupal Steward partners have been made aware of this issue. Some platforms may provide mitigations. However, not all WAF configurations can mitigate the issue, so it is still recommended to update promptly to this security release if your site uses JSON:API. (SA-CORE-2023-006)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
SolutionUpgrade to Drupal version 9.5.11 / 10.0.11 / 10.1.4 or later.
File Name: drupal_10_1_4.nasl
Configuration: Enable paranoid mode, Enable thorough checks
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Required KB Items: Settings/ParanoidReport, installed_sw/Drupal
Exploit Ease: No known exploits are available
Patch Publication Date: 9/20/2023
Vulnerability Publication Date: 9/20/2023