## Drupal core - Moderately critical - Access bypass - SA-CORE-2023-004

- 種別: advisory
- 重大度: critical
- 関連技術: drupal, php
- 公開日時: 2023-03-15T16:26:24.000Z
- 情報源: Drupal Security Advisories (https://www.drupal.org/sa-core-2023-004)
- パーマリンク: https://vulnpulse.app/items/drupal-security-1577aaac8ec7

Project: Drupal core Project machine name: drupal Date: 2023-March-15 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <7.95 || >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5 Description: Drupal core provides a page that outputs the markup from phpinfo() to assist with diagnosing PHP configuration. If an attacker was able to achieve an XSS exploit against a privileged user, they may be able to use the phpinfo page to access sensitive information that could be used to escalate the attack…