Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005

Project: Drupal core Project machine name: drupal Date: 2023-April-19 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <7.96.0 || >=9.4.0 <9.4.14 || >=9.5.0 <9.5.8 || >=10.0.0 <10.0.8 || 8.0.* || 8.1.* || 8.2.* || 8.3.* || 8.4.* || 8.5.* || 8.6.* || 8.7.* || 8.8.* || 8.9.* || 9.0.* || 9.1.* || 9.2.* || 9.3.* CVE IDs: CVE-2023-31250 Description: The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they…

Drupal Security Advisoriesで読む