CVE-2023-5256

Drupal core - Critical - Cache poisoning - SA-CORE-2023-006

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.

We have discovered 40,725 live websites that are affected by CVE-2023-5256.

Run a Free Instant Scan



Affected Software

Product  Drupal
Category Content Management System
Vulnerable Domains40,725 live websites (20% of Drupal install base)
Vulnerable Versions
  • from 9.5 through 9.5.11
  • from 10 through 10.0.11
  • from 10.1 through 10.1.4
Vulnerable Versions Count27 versions ( 7.74% of all versions)


Common Weakness Enumeration

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor



Details

  • Published - Sep 28, 2023
  • Updated - Sep 23, 2024

Website Distribution by Country

Number of websites using CVE-2023-5256
United States15,998 websites


Germany4,164 websites
France3,138 websites
Belgium2,322 websites
Netherlands1,591 websites
GB1,541 websites
Canada1,122 websites
Switzerland923 websites
Italy811 websites
Russia784 websites

Website Distribution by TLD

Number of websites using CVE-2023-5256
.com8,778 websites
.org4,478 websites
.edu4,093 websites
.de2,974 websites
.be2,209 websites
.fr1,903 websites
.nl1,557 websites
.ca1,059 websites
.ch749 websites
.it701 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2023-5256

Top websites that are affected by CVE-2023-5256. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.**.uk GB***
***.gov United States***
******.com United States*,***
****.gov United States*,***
******.gov United States*,***
***.gov United States*,***
******.edu France*,***
***.gov United States*,***
***.***.uk United States*,***
******.com United States*,***
See full domain list

FAQ

CVE-2023-5256 is Exposure of Sensitive Information to an Unauthorized Actor in Drupal
A total of 40,725 websites have been identified as vulnerable to CVE-2023-5256, based on global website indexing conducted by WebTechSurvey.
The Drupal is affected by the CVE-2023-5256 vulnerability.
Drupal versions up to and including 10.1.4 are vulnerable to CVE-2023-5256.