Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-003

{
  "id": "0db687fca29d15180b4dc25f6625fff65bda2d5443dfe2760e90194d30a77293",
  "url": "https://www.drupal.org/sa-core-2023-003",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-003",
    "summary": "Drupal core’s language switcher can disclose URLs of unpublished translations, potentially exposing unpublished content titles when used with modules such as Pathauto. Update to the listed fixed version for your Drupal release.",
    "evidence": "The URL of unpublished translations may be disclosed.",
    "products": [
      {
        "name": {
          "value": "Drupal core",
          "evidence": "Drupal core"
        },
        "prerequisites": [
          {
            "value": "When used in conjunction with a module like Pathauto",
            "evidence": "When used in conjunction with a module like Pathauto, this may reveal the title of unpublished content."
          }
        ],
        "fixed_versions": [
          {
            "value": "Drupal 10.0.5",
            "evidence": "If you are using Drupal 10.0, update to Drupal 10.0.5."
          },
          {
            "value": "Drupal 9.5.5",
            "evidence": "If you are using Drupal 9.5, update to Drupal 9.5.5."
          },
          {
            "value": "Drupal 9.4.12",
            "evidence": "If you are using Drupal 9.4, update to Drupal 9.4.12."
          }
        ],
        "affected_versions": [
          {
            "value": ">=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5",
            "evidence": ">=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-drupal-security",
  "document_id": 23488,
  "published_at": "2023-03-15T16:24:29+00:00"
}