In certain scenarios, Drupal’s JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.
This vulnerability affects the following application versions:
- Drupal 8.8.0
- Drupal 8.8.1
- Drupal 8.8.2
- Drupal 8.8.3
- Drupal 8.8.4
- Drupal 8.8.5
- Drupal 8.8.6
- Drupal 8.8.7
- Drupal 8.8.8
- Drupal 8.8.9
- Drupal 8.8.10
- Drupal 8.8.11
- Drupal 8.8.12
- Drupal 8.9.0
- Drupal 8.9.1
- Drupal 8.9.2
- Drupal 8.9.3
- Drupal 8.9.4
- Drupal 8.9.5
- Drupal 8.9.6
- Drupal 8.9.7
- Drupal 8.9.8
- Drupal 8.9.9
- Drupal 8.9.10
- Drupal 8.9.11
- Drupal 8.9.12
- Drupal 8.9.13
- Drupal 8.9.14
- Drupal 8.9.15
- Drupal 8.9.16
- Drupal 8.9.17
- Drupal 8.9.18
- Drupal 8.9.19
- Drupal 8.9.20
- Drupal 9.0.0
- Drupal 9.0.1
- Drupal 9.0.2
- Drupal 9.0.3
- Drupal 9.0.4
- Drupal 9.0.5
- Drupal 9.0.6
- Drupal 9.0.7
- Drupal 9.0.8
- Drupal 9.0.9
- Drupal 9.0.10
- Drupal 9.0.11
- Drupal 9.0.12
- Drupal 9.0.13
- Drupal 9.0.14
- Drupal 9.1.0
- Drupal 9.1.1
- Drupal 9.1.2
- Drupal 9.1.3
- Drupal 9.1.4
- Drupal 9.1.5
- Drupal 9.1.6
- Drupal 9.1.7
- Drupal 9.1.8
- Drupal 9.1.9
- Drupal 9.1.10
- Drupal 9.1.11
- Drupal 9.1.12
- Drupal 9.1.13
- Drupal 9.1.14
- Drupal 9.1.15
- Drupal 9.2.0
- Drupal 9.2.1
- Drupal 9.2.2
- Drupal 9.2.3
- Drupal 9.2.4
- Drupal 9.2.5
- Drupal 9.2.6
- Drupal 9.2.7
- Drupal 9.2.8
- Drupal 9.2.9
- Drupal 9.2.10
- Drupal 9.2.11
- Drupal 9.2.12
- Drupal 9.2.13
- Drupal 9.2.14
- Drupal 9.2.15
- Drupal 9.2.16
- Drupal 9.2.17
- Drupal 9.2.18
- Drupal 9.2.19
- Drupal 9.2.20
- Drupal 9.2.21
- Drupal 9.3.0
- Drupal 9.3.1
- Drupal 9.3.2
- Drupal 9.3.3
- Drupal 9.3.4
- Drupal 9.3.5
- Drupal 9.3.6
- Drupal 9.3.7
- Drupal 9.3.8
- Drupal 9.3.9
- Drupal 9.3.10
- Drupal 9.3.11
- Drupal 9.3.12
- Drupal 9.3.13
- Drupal 9.3.14
- Drupal 9.3.15
- Drupal 9.3.16
- Drupal 9.3.17
- Drupal 9.3.18
- Drupal 9.3.19
- Drupal 9.3.20
- Drupal 9.3.21
- Drupal 9.3.22
- Drupal 9.4.0
- Drupal 9.4.1
- Drupal 9.4.2
- Drupal 9.4.3
- Drupal 9.4.4
- Drupal 9.4.5
- Drupal 9.4.6
- Drupal 9.4.7
- Drupal 9.4.8
- Drupal 9.4.9
- Drupal 9.4.10
- Drupal 9.4.11
- Drupal 9.4.12
- Drupal 9.4.13
- Drupal 9.4.14
- Drupal 9.4.15
- Drupal 9.5.0
- Drupal 9.5.1
- Drupal 9.5.2
- Drupal 9.5.3
- Drupal 9.5.4
- Drupal 9.5.5
- Drupal 9.5.6
- Drupal 9.5.7
- Drupal 9.5.8
- Drupal 9.5.9
- Drupal 9.5.10
- Drupal 10.0.0
- Drupal 10.0.1
- Drupal 10.0.2
- Drupal 10.0.3
- Drupal 10.0.4
- Drupal 10.0.5
- Drupal 10.0.6
- Drupal 10.0.7
- Drupal 10.0.8
- Drupal 10.0.9
- Drupal 10.0.10
- Drupal 10.1.0
- Drupal 10.1.1
- Drupal 10.1.2
- Drupal 10.1.3