{"id":"drupal-security-1577aaac8ec7","seq":2036,"kind":"advisory","title":"Drupal core - Moderately critical - Access bypass - SA-CORE-2023-004","url":"https://www.drupal.org/sa-core-2023-004","permalink":"https://vulnpulse.app/items/drupal-security-1577aaac8ec7","summary":"Project: Drupal core Project machine name: drupal Date: 2023-March-15 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <7.95 || >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5 Description: Drupal core provides a page that outputs the markup from phpinfo() to assist with diagnosing PHP configuration. If an attacker was able to achieve an XSS exploit against a privileged user, they may be able to use the phpinfo page to access sensitive information that could be used to escalate the attack…","severity":"critical","techs":["drupal","php"],"cves":[],"tags":["security"],"source":{"id":"drupal-security","name":"Drupal Security Advisories"},"published_at":"2023-03-15T16:26:24.000Z","fetched_at":"2026-10-21T16:17:45.699Z"}