CVE-2023-31250 json
Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005
published 2023-04-19 3 y ago modified 2026-09-19 51 d ago also BIT-drupal-2023-31250 , DRUPAL-CORE-2023-005 , EUVD-2023-1236 , GHSA-8849-cv9f-vccm
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.
Patch / fix
- packagist drupal/core 7.96, 9.4.14, 9.5.8, 10.0.8
- bitnami drupal 7.96.0, 9.4.14, 9.5.8, 10.0.8
- Drupal Core 7.96, 9.4.14, 9.5.8, 10.0.8
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | drupal/core | >=10.0.0, <10.0.8 >=9.5.0, <9.5.8 >=9.0.0, <9.4.14 >=7.0.0, <7.96 >=8.0.0, <9.4.14 |
10.0.8 9.5.8 9.4.14 7.96 |
| bitnami | drupal | >=7.0.0, <7.96.0 >=9.4.0, <9.4.14 >=9.5.0, <9.5.8 >=10.0.0, <10.0.8 |
7.96.0 9.4.14 9.5.8 10.0.8 |
Affected products
- Drupal Core
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
drupal.org
/sa-core-2023-005
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-31250
advisory, web
-
github.com
/drupal/core
package
Sources
- CVE List CVE-2023-31250
- GitHub Advisory GHSA-8849-cv9f-vccm
- NVD CVE-2023-31250
- OSV BIT-drupal-2023-31250
- OSV DRUPAL-CORE-2023-005
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.