DRUPAL-CORE-2023-004 in drupal/core
Published 15 Mar 2023 · Updated 19 Sept 2026
Affected package
- Affected
- >=8.0.0 <9.4.12 · >=9.5.0 <9.5.5 · >=10.0.0 <10.0.5
- Fixed in
- 9.4.12, 9.5.5, 10.0.5
composer require drupal/core:^10.0.5Details
Drupal core provides a page that outputs the markup from phpinfo() to assist with diagnosing PHP configuration.
If an attacker was able to achieve an XSS exploit against a privileged user, they may be able to use the phpinfo page to access sensitive information that could be used to escalate the attack.
This vulnerability is mitigated by the fact that a successful XSS exploit is required in order to exploit it.
Is DRUPAL-CORE-2023-004 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected drupal/core, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.