Originally reported to the Drupal security team by @torotil → on 15 October 2020. Assuming it affects the latest version, this issue's version is set to D10.0.
---
While page cache
is case-insensitve →
language prefixes are case sensitive. This means /EN/node/1 might return a 404 even though /en/node/1 does not. Both will end up in the same bucket in the page cache, thus the result depends on which one ends up there first.
/de/node/1)With this knowledge an attacker might send properly timed requests (trying to populate the page cache whenever it is cleared) and thereby effectively “unpublishing“ all non-default-language content of a site.
Active
7.0 ⚰️
Last updated
It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.