## Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005

- 種別: advisory
- 重大度: critical
- 関連技術: drupal, php
- CVE: CVE-2023-31250
- 公開日時: 2023-04-19T17:06:18.000Z
- 情報源: Drupal Security Advisories (https://www.drupal.org/sa-core-2023-005)
- パーマリンク: https://vulnpulse.app/items/drupal-security-6124fbccfc6a

Project: Drupal core Project machine name: drupal Date: 2023-April-19 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <7.96.0 || >=9.4.0 <9.4.14 || >=9.5.0 <9.5.8 || >=10.0.0 <10.0.8 || 8.0.* || 8.1.* || 8.2.* || 8.3.* || 8.4.* || 8.5.* || 8.6.* || 8.7.* || 8.8.* || 8.9.* || 9.0.* || 9.1.* || 9.2.* || 9.3.* CVE IDs: CVE-2023-31250 Description: The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they…