PUBLISHED
2025-11-18 17:15
MODIFIED
2025-11-18 17:15
EPSS (Prob. Exploit)
0.28%
Top 79.6%
> DESCRIPTION
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-525: Use of Web Browser Cache Containing Sensitive Information - The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
> GITHUB SECURITY ADVISORY
GHSA-mhpg-hpj5-73r2
LOW
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
AFFECTED PACKAGES:
COMPOSER / drupal/core
>= 7.0, < 7.103
Fixed in: 7.103
COMPOSER / drupal/core
>= 11.2.0, < 11.2.8
Fixed in: 11.2.8
COMPOSER / drupal/core
>= 11.0.0, < 11.1.9
Fixed in: 11.1.9
COMPOSER / drupal/core
>= 10.5.0, < 10.5.6
Fixed in: 10.5.6
COMPOSER / drupal/core
>= 8.0.0, < 10.4.9
Fixed in: 10.4.9
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008
AFFECTED PACKAGES:
Unknown / Unknown
92 versions affected
ALIASES:
BIT-drupal-2025-13083, DRUPAL-CORE-2025-008, GHSA-mhpg-hpj5-73r2
> HISTORIQUE DES MODIFICATIONS
Première apparition
18/11/2025 17:15
Source: NVD
📊
ENRICHISSEMENT
19/01/2026 17:37
CVEPROJECT
Champ modifié: CVE Project
📊
ENRICHISSEMENT
01/12/2025 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-525: Use of Web Browser Cache Containing Sensitive Information - The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form...
Total des modifications: 2
Dernière mise à jour: 9 months ago