Drupal core - Moderately critical - Access bypass - SA-CORE-2023-004

{
  "id": "8af65262b491b491ead38f1d9f215a929dec131dfe6506921bfb4a7a59a944cc",
  "url": "https://www.drupal.org/sa-core-2023-004",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Drupal core - Moderately critical - Access bypass - SA-CORE-2023-004",
    "summary": "Drupal core's phpinfo page could expose sensitive information to an attacker who first achieved an XSS exploit against a privileged user. Upgrade to the applicable fixed version.",
    "evidence": "Drupal core provides a page that outputs the markup from phpinfo() to assist with diagnosing PHP configuration. If an attacker was able to achieve an XSS exploit against a privileged user, they may be able to use the phpinfo page to access sensitive information that could be used to escalate the attack.",
    "products": [
      {
        "name": {
          "value": "Drupal core",
          "evidence": "Project: Drupal core"
        },
        "prerequisites": [
          {
            "value": "a successful XSS exploit is required in order to exploit it",
            "evidence": "This vulnerability is mitigated by the fact that a successful XSS exploit is required in order to exploit it."
          }
        ],
        "fixed_versions": [
          {
            "value": "Drupal 10.0.5",
            "evidence": "If you are using Drupal 10.0, update to Drupal 10.0.5."
          },
          {
            "value": "Drupal 9.5.5",
            "evidence": "If you are using Drupal 9.5, update to Drupal 9.5.5."
          },
          {
            "value": "Drupal 9.4.12",
            "evidence": "If you are using Drupal 9.4, update to Drupal 9.4.12."
          },
          {
            "value": "Drupal 7.95",
            "evidence": "If you are using Drupal 7, update to Drupal 7.95."
          }
        ],
        "affected_versions": [
          {
            "value": "<7.95",
            "evidence": "Affected versions: <7.95 || >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5"
          },
          {
            "value": ">=8.0.0 <9.4.12",
            "evidence": "Affected versions: <7.95 || >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5"
          },
          {
            "value": ">=9.5.0 <9.5.5",
            "evidence": "Affected versions: <7.95 || >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5"
          },
          {
            "value": ">=10.0.0 <10.0.5",
            "evidence": "Affected versions: <7.95 || >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-drupal-security",
  "document_id": 23487,
  "published_at": "2023-03-15T16:26:24+00:00"
}