CVE-2025-13083

Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

Description

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.

Scores

Faiblesses (CWE)

• CWE-525

Avis

• DRUPAL-CORE-2025-008 — The core `system` module handles downloads of private and temporary files. Contrib modules can define additional kinds of files (schemes) that may also be handl
• GHSA-mhpg-hpj5-73r2 — Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels

Références européennes

• ENISA EUVD · EUVD-2025-198027
• GCVE · GCVE-0-2025-13083

Avis du CERT-FR

• CERTFR-2025-AVI-1003 — Multiples vulnérabilités dans Drupal · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 8.0.0 < 10.4.9
• cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 10.5.0 < 10.5.6
• cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.1.9
• cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 11.2.0 < 11.2.8

Produits affectés

Références

• https://www.drupal.org/sa-core-2025-008

Sources