Biztonsági figyelmeztetések (core)
Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005
The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to.
Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.
This advisory is covered by Drupal Steward.
We would normally not apply for a release of this severity. However, in this case we have chosen to apply Drupal Steward security coverage to test our processes.
Drupal 7- All Drupal 7 sites on Windows web servers are vulnerable.
- Drupal 7 sites on Linux web servers are vulnerable with certain file directory structures, or if a vulnerable contributed or custom file access module is installed.
Drupal 9 and 10 sites are only vulnerable if certain contributed or custom file access modules are installed.
Solution:Install the latest version:
- If you are using Drupal 10.0, update to Drupal 10.0.8.
- If you are using Drupal 9.5, update to Drupal 9.5.8.
- If you are using Drupal 9.4, update to Drupal 9.4.14.
- If you are using Drupal 7, update to Drupal 7.96.
All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life.
Reported By:- Heine of the Drupal Security Team
- Conrad Lara
- Guy Elsmore-Paddock
- Michael Hess of the Drupal Security Team
- Heine of the Drupal Security Team
- Lee Rowlands of the Drupal Security Team
- David Rothstein of the Drupal Security Team
- xjm of the Drupal Security Team
- Wim Leers
- Damien McKenna of the Drupal Security Team
- Alex Bronstein of the Drupal Security Team
- Conrad Lara
- Peter Wolanin of the Drupal Security Team
- Drew Webber of the Drupal Security Team
- Benji Fisher of the Drupal Security Team
- Juraj Nemec, provisional member of the Drupal Security Team
- Jen Lampton, provisional member of the Drupal Security Team
- Dave Long of the Drupal Security Team
- Kim Pepper
- Alex Pott of the Drupal Security Team
- Neil Drumm of the Drupal Security Team
Drupal core - Moderately critical - Access bypass - SA-CORE-2023-004
Drupal core provides a page that outputs the markup from phpinfo() to assist with diagnosing PHP configuration.
If an attacker was able to achieve an XSS exploit against a privileged user, they may be able to use the phpinfo page to access sensitive information that could be used to escalate the attack.
This vulnerability is mitigated by the fact that a successful XSS exploit is required in order to exploit it.
Solution:Install the latest version:
- If you are using Drupal 10.0, update to Drupal 10.0.5.
- If you are using Drupal 9.5, update to Drupal 9.5.5.
- If you are using Drupal 9.4, update to Drupal 9.4.12.
- If you are using Drupal 7, update to Drupal 7.95.
All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life.
Reported By: Fixed By:- Damien McKenna of the Drupal Security Team
- Elar Lang
- Lee Rowlands of the Drupal Security Team
- Alex Bronstein of the Drupal Security Team
- Joseph Zhao Provisional Member of the Drupal Security Team
- Drew Webber of the Drupal Security Team
- Jen Lampton Provisional Member of the Drupal Security Team
- Nate Lampton
- Greg Knaddison of the Drupal Security Team
Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-003
The language module provides a Language switcher block which can be placed to provide links to quickly switch between different languages.
The URL of unpublished translations may be disclosed. When used in conjunction with a module like Pathauto, this may reveal the title of unpublished content.
This advisory is not covered by Drupal Steward.
Solution:Install the latest version:
- If you are using Drupal 10.0, update to Drupal 10.0.5.
- If you are using Drupal 9.5, update to Drupal 9.5.5.
- If you are using Drupal 9.4, update to Drupal 9.4.12.
All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life.
Drupal 7 core does not include the Language module and therefore is not affected. The contributed modules for translation do not have the same code for language-switching links, so they are not affected, either.
Reported By: Fixed By:- Jan Kellermann
- Lee Rowlands of the Drupal Security Team
- Greg Knaddison of the Drupal Security Team
- Benji Fisher of the Drupal Security Team
- Jess of the Drupal Security Team
- Sascha Grossenbacher
- Neil Drumm of the Drupal Security Team
- Dave Long of the Drupal Security Team
Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-002
The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files.
This release was coordinated with SA-CONTRIB-2023-010.
This advisory is not covered by Drupal Steward.
Solution:Install the latest version:
- If you are using Drupal 10.0, update to Drupal 10.0.5.
- If you are using Drupal 9.5, update to Drupal 9.5.5.
- If you are using Drupal 9.4, update to Drupal 9.4.12.
All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life.
Drupal 7 core does not include the Media Library module and therefore is not affected.
Reported By: Fixed By:- Lee Rowlands of the Drupal Security Team
- James Williams
- Jess of the Drupal Security Team
- Dave Long of the Drupal Security Team
- Dan Flanagan
- Jen Lampton Provisional Member of the Drupal Security Team
- Joseph Zhao Provisional Member of the Drupal Security Team
- Benji Fisher of the Drupal Security Team
