{"id":3243,"date":"2023-01-20T09:18:03","date_gmt":"2023-01-20T14:18:03","guid":{"rendered":"https:\/\/cert.pa\/?p=3243"},"modified":"2023-01-20T09:18:03","modified_gmt":"2023-01-20T14:18:03","slug":"csirt-panama-aviso-2023-01-19-drupal-vulnerabilidad-critica-en-drupal","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=3243","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2023-01-19 Drupal: Vulnerabilidad cr\u00edtica en Drupal"},"content":{"rendered":"\n

CSIRT Panam\u00e1 Aviso 2023-01-19 Drupal: Vulnerabilidad cr\u00edtica en Drupal<\/p>\n\n\n\n

Gravedad: Alta
Fecha de publicaci\u00f3n: enero 19, 2023
\u00daltima revisi\u00f3n: enero 19, 2023
Sitio web: https:\/\/www.drupal.org\/
Sistemas Afectados:
\u2022 Versiones comprendidas entre la 8.0.0 (incluida) hasta la 9.4.10 (no incluida).
\u2022 Versiones comprendidas entre la 9.5.0 (incluida) hasta la 9.5.2 (no incluida).
\u2022 Versiones comprendidas entre la 10.0.0 (incluida) hasta la 10.0.2 (no incluida).<\/p>\n\n\n\n

I. Descripci\u00f3n<\/p>\n\n\n\n

Se han publicado la actualizaci\u00f3n del software Drupal 10.0, 9.5 y 9.4 que corrige una vulnerabilidad cr\u00edtica en el n\u00facleo.<\/p>\n\n\n\n

II. Impacto<\/p>\n\n\n\n

La vulnerabilidad de severidad cr\u00edtica detectada afecta al m\u00f3dulo de la biblioteca y no verifica correctamente el acceso a la entidad en algunas circunstancias. Esto podr\u00eda provocar que los usuarios con acceso para editar contenido vean metadatos de elementos multimedia para los que no est\u00e1n autorizados.<\/p>\n\n\n\n

III. Referencia a soluciones, herramientas e informaci\u00f3n<\/p>\n\n\n\n

Actualizar a la versi\u00f3n de Drupal, mediante los siguientes enlaces:<\/p>\n\n\n\n

\u2022 Para Drupal 10.0, actualiza a Drupal 10.0.2. Enlace: https:\/\/www.drupal.org\/project\/drupal\/releases\/10.0.2
\u2022 Para Drupal 9.5, actualiza a Drupal 9.5.2. Enlace: https:\/\/www.drupal.org\/project\/drupal\/releases\/9.5.2
\u2022 Para Drupal 9.4, actualiza a Drupal 9.4.10. Enlace: https:\/\/www.drupal.org\/project\/drupal\/releases\/9.4.10<\/p>\n\n\n\n

Fuentes:<\/p>\n\n\n\n

  1. Instituto Nacional de Ciberseguridad, INCIBE. Avisos Seguridad, Vulnerabilidad cr\u00edtica en Drupal. 19 de enero del 2023. Recopilado en: https:\/\/www.incibe-cert.es\/alerta-temprana\/avisos-seguridad\/vulnerabilidad-critica-drupal<\/li>
  2. Drupal Oficial. 18 de enero del 2023. Drupal core – Moderately critical – Information Disclosure – SA-CORE-2023-001. Recopilado en: https:\/\/www.drupal.org\/sa-core-2023-001<\/li><\/ol>\n\n\n\n

    Informaci\u00f3n de contacto
    CSIRT PANAMA
    Computer Security Incident Response Team Autoridad Nacional para la Innovacion Gubernamental
    E-Mail: info@cert.pa
    Phone: +507 520-CERT (2378)
    Web: https:\/\/cert.pa
    Twitter: @CSIRTPanama
    Key ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"

    CSIRT Panam\u00e1 Aviso 2023-01-19 Drupal: Vulnerabilidad cr\u00edtica en Drupal Gravedad: AltaFecha de publicaci\u00f3n: enero 19, 2023\u00daltima revisi\u00f3n: enero 19, 2023Sitio web: https:\/\/www.drupal.org\/Sistemas Afectados:\u2022 Versiones comprendidas entre la 8.0.0 (incluida) hasta la 9.4.10 (no incluida).\u2022 Versiones…<\/p>\n","protected":false},"author":4,"featured_media":941,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[72],"class_list":["post-3243","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad","tag-avisos-de-seguridad"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3243"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3243\/revisions"}],"predecessor-version":[{"id":3244,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3243\/revisions\/3244"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/941"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}