Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012

{
  "id": "4677e567d3d89726145c8ae5f4c0706e6e37982d048913fe24c242d0ea8138f6",
  "url": "https://www.drupal.org/sa-core-2022-012",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012",
    "summary": "Drupal core releases address an image-file access-check issue that could disclose non-public files when insecure derivatives are enabled. Update to the applicable fixed version.",
    "evidence": "In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system.",
    "products": [
      {
        "name": {
          "value": "Drupal core",
          "evidence": "Project: Drupal core"
        },
        "prerequisites": [
          {
            "value": "the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE",
            "evidence": "This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE."
          }
        ],
        "fixed_versions": [
          {
            "value": "Drupal 9.4.3",
            "evidence": "If you are using Drupal 9.4, update to Drupal 9.4.3."
          },
          {
            "value": "Drupal 9.3.19",
            "evidence": "If you are using Drupal 9.3, update to Drupal 9.3.19."
          },
          {
            "value": "Drupal 7.91",
            "evidence": "If you are using Drupal 7, update to Drupal 7.91."
          }
        ],
        "affected_versions": [
          {
            "value": ">=7.0 <7.91",
            "evidence": "Affected versions: >=7.0 <7.91 || >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3"
          },
          {
            "value": ">= 8.0.0 <9.3.19",
            "evidence": "Affected versions: >=7.0 <7.91 || >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3"
          },
          {
            "value": ">= 9.4.0 <9.4.3",
            "evidence": "Affected versions: >=7.0 <7.91 || >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2022-25275",
        "evidence": "CVE IDs: CVE-2022-25275"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-drupal-security",
  "document_id": 23495,
  "published_at": "2022-07-20T15:34:05+00:00"
}