CVE-2023-5256

Name	CVE-2023-5256
Description	In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
drupal7 (PTS)	jessie, jessie (lts)	7.32-1+deb8u19	vulnerable
	stretch (security), stretch (lts), stretch	7.52-2+deb9u18	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
drupal7	source	jessie	(unfixed)	end-of-life
drupal7	source	stretch	(unfixed)	end-of-life
drupal7	source	(unstable)	(unfixed)