The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.
References
| Link | Resource |
|---|---|
| https://www.drupal.org/sa-core-2023-005 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
05 May 2023, 15:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://www.drupal.org/sa-core-2023-005 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CPE | cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* | |
| CWE | CWE-863 |
26 Apr 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-26 19:15
Updated : 2024-02-04 23:37
NVD link : CVE-2023-31250
Mitre link : CVE-2023-31250
CVE.ORG link : CVE-2023-31250
JSON object : View
Products Affected
drupal
- drupal
CWE
CWE-863
Incorrect Authorization