CVE-2025-13083

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13083", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-11-12T18:26:39.713Z", "datePublished": "2025-11-18T16:55:37.269Z", "dateUpdated": "2026-01-16T20:14:00.799Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/drupal", "defaultStatus": "unaffected", "product": "Drupal core", "repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "versions": [{"lessThan": "10.4.9", "status": "affected", "version": "8.0.0", "versionType": "semver"}, {"lessThan": "10.5.6", "status": "affected", "version": "10.5.0", "versionType": "semver"}, {"lessThan": "11.1.9", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThan": "11.2.8", "status": "affected", "version": "11.2.0", "versionType": "semver"}, {"lessThanOrEqual": "7.103", "status": "affected", "version": "7.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Damien McKenna (damienmckenna)"}, {"lang": "en", "type": "finder", "value": "tame4tex"}, {"lang": "en", "type": "remediation developer", "value": "Benji Fisher (benjifisher)"}, {"lang": "en", "type": "remediation developer", "value": "catch (catch)"}, {"lang": "en", "type": "remediation developer", "value": "Neil Drumm (drumm)"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Mingsong (mingsong)"}, {"lang": "en", "type": "remediation developer", "value": "Mohit Aghera (mohit_aghera)"}, {"lang": "en", "type": "remediation developer", "value": "James Gilliland (neclimdul)"}, {"lang": "en", "type": "remediation developer", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "remediation developer", "value": "Jess (xjm)"}, {"lang": "en", "type": "coordinator", "value": "catch (catch)"}, {"lang": "en", "type": "coordinator", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "coordinator", "value": "Dave Long (longwave)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "datePublic": "2025-11-12T20:16:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.</p>"}], "value": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-525", "description": "CWE-525 Use of Web Browser Cache Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-01-16T20:14:00.799Z"}, "references": [{"url": "https://www.drupal.org/sa-core-2025-008"}], "source": {"discovery": "UNKNOWN"}, "title": "Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T20:31:33.666610Z", "id": "CVE-2025-13083", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T20:31:36.720Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-13083", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T20:31:33.666610Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T20:31:28.587Z"}}], "cna": {"title": "Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Damien McKenna (damienmckenna)"}, {"lang": "en", "type": "finder", "value": "tame4tex"}, {"lang": "en", "type": "remediation developer", "value": "Benji Fisher (benjifisher)"}, {"lang": "en", "type": "remediation developer", "value": "catch (catch)"}, {"lang": "en", "type": "remediation developer", "value": "Neil Drumm (drumm)"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Mingsong (mingsong)"}, {"lang": "en", "type": "remediation developer", "value": "Mohit Aghera (mohit_aghera)"}, {"lang": "en", "type": "remediation developer", "value": "James Gilliland (neclimdul)"}, {"lang": "en", "type": "remediation developer", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "remediation developer", "value": "Jess (xjm)"}, {"lang": "en", "type": "coordinator", "value": "catch (catch)"}, {"lang": "en", "type": "coordinator", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "coordinator", "value": "Dave Long (longwave)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "product": "Drupal core", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "10.4.9", "versionType": "semver"}, {"status": "affected", "version": "10.5.0", "lessThan": "10.5.6", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.1.9", "versionType": "semver"}, {"status": "affected", "version": "11.2.0", "lessThan": "11.2.8", "versionType": "semver"}, {"status": "affected", "version": "7.0", "versionType": "semver", "lessThanOrEqual": "7.103"}], "collectionURL": "https://www.drupal.org/project/drupal", "defaultStatus": "unaffected"}], "datePublic": "2025-11-12T20:16:00.000Z", "references": [{"url": "https://www.drupal.org/sa-core-2025-008"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.", "supportingMedia": [{"type": "text/html", "value": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-525", "description": "CWE-525 Use of Web Browser Cache Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-01-16T20:14:00.799Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13083", "state": "PUBLISHED", "dateUpdated": "2026-01-16T20:14:00.799Z", "dateReserved": "2025-11-12T18:26:39.713Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-11-18T16:55:37.269Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.drupal.org/project/drupal", "defaultStatus": "unaffected", "product": "Drupal core", "repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "versions": [{"lessThan": "10.4.9", "status": "affected", "version": "8.0.0", "versionType": "semver"}, {"lessThan": "10.5.6", "status": "affected", "version": "10.5.0", "versionType": "semver"}, {"lessThan": "11.1.9", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThan": "11.2.8", "status": "affected", "version": "11.2.0", "versionType": "semver"}, {"lessThanOrEqual": "7.103", "status": "affected", "version": "7.0", "versionType": "semver"}]}], "source": "mlhess@drupal.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "187161BC-CF72-4A12-9DA7-637A024DD97A", "versionEndExcluding": "10.4.9", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "6637885B-CE3E-4FCE-9899-A21BA12F6C87", "versionEndExcluding": "10.5.6", "versionStartIncluding": "10.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "A80C15FD-FB6B-4E22-B836-8A18842BEED0", "versionEndExcluding": "11.1.9", "versionStartIncluding": "11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D477FF8-4E52-43B9-8799-36DAEB8524E0", "versionEndExcluding": "11.2.8", "versionStartIncluding": "11.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103."}, {"lang": "es", "value": "Vulnerabilidad de uso de la cach\u00e9 del navegador web que contiene informaci\u00f3n sensible en Drupal Drupal core permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Drupal core: desde 8.0.0 antes de 10.4.9, desde 10.5.0 antes de 10.5.6, desde 11.0.0 antes de 11.1.9, desde 11.2.0 antes de 11.2.8."}], "id": "CVE-2025-13083", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13083", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T20:31:33.666610Z", "version": "2.0.3"}}]}, "published": "2025-11-18T17:15:59.313", "references": [{"source": "mlhess@drupal.org", "tags": ["Vendor Advisory"], "url": "https://www.drupal.org/sa-core-2025-008"}], "sourceIdentifier": "mlhess@drupal.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-525"}], "source": "mlhess@drupal.org", "type": "Secondary"}]}

{}

{"created": "2025-11-19T10:47:44.476454+00:00", "updated": "2025-11-19T10:47:44.476480+00:00", "vendors": ["drupal", "drupal$PRODUCT$drupal", "drupal$PRODUCT$drupal_core"]}