CVE-2020-13674
published 2022-02-11CVE-2020-13674: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible…
PriorityP430medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
0.45%
35.8th percentile
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| drupal | core | >= 8.0.0 < 8.9.19 | 8.9.19 |
| drupal | core | >= 8.9 < 8.9.19 | 8.9.19 |
| drupal | core | >= 9.1 < 9.1.13 | 9.1.13 |
| drupal | core | >= 9.1.0 < 9.1.13 | 9.1.13 |
| drupal | core | >= 9.2 < 9.2.6 | 9.2.6 |
| drupal | core | >= 9.2.0 < 9.2.6 | 9.2.6 |
| drupal | drupal | >= 8.9.0 < 8.9.19 | 8.9.19 |
| drupal | drupal | >= 9.1.0 < 9.1.13 | 9.1.13 |
| drupal | drupal | >= 9.2.0 < 9.2.6 | 9.2.6 |
| drupal | drupal_core | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Cross-Site Request Forgery in Drupal core
ghsa·2022-02-12
CVE-2020-13674 [MEDIUM] CWE-352 Cross-Site Request Forgery in Drupal core
Cross-Site Request Forgery in Drupal core
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
OSV
Cross-Site Request Forgery in Drupal core
osv·2022-02-12
CVE-2020-13674 [MEDIUM] Cross-Site Request Forgery in Drupal core
Cross-Site Request Forgery in Drupal core
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
OSV
CVE-2020-13674: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to po
osv·2022-02-11·CVSS 6.5
CVE-2020-13674 [MEDIUM] CVE-2020-13674: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to po
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
OSV
CVE-2020-13674: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to po
osv·2021-09-15
CVE-2020-13674 CVE-2020-13674: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to po
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues.
Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users **will not** fully mitigate the vulnerability.
This advisory is not covered by [Drupal Steward](/steward).
Drupal
Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-007
vendor_drupal·2021-09-15
CVE-2020-13674 [MEDIUM] Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-007
Title: Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-007
Vulnerability Type: Cross Site Request Forgery
Description: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability. This advisory is not covered by Drupal Steward .
Solution: Install the latest version: If you are using Drupal 9.2, update to Drupal 9.2.6 . If you are using Drupal 9.1, update to Drupal 9.1.13 . If you are using Drupal 8.9, update to Drupal 8.9.19 . V
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-02-11
Published