⚠ Actively exploited
Added to CISA KEV on 2022-01-18. Federal agencies required to patch by 2022-07-18. Required action: Apply updates per vendor instructions..
CVE-2020-13671 — Unrestricted File Upload in Drupal
Severity
8.8HIGHNVD
EPSS
4.5%
top 10.86%
CISA KEV
KEV
Added 2022-01-18
Due 2022-07-18
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedNov 20
KEV addedJan 18
KEV dueJul 18
Latest updateSep 3
CISA Required Action: Apply updates per vendor instructions.
Description
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages4 packages
Also affects: Fedora 32, 33
🔴Vulnerability Details
8CVEList▶
CVE-2020-13671: Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and s↗2020-11-20