CVE-2020-13675 — Improper Access Control in Drupal Core

CWE-284 — Improper Access ControlCWE-434 — Unrestricted File Upload9 documents5 sources
Severity
9.8CRITICALNVD
EPSS
0.8%
top 25.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Drupal CoreDrupalDrupal Graphql
Timeline
PublishedFeb 11
Latest updateFeb 12

Description

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5drupal/core9.2.x — 9.2.6+2
▶Packagistdrupal/core8.0.0 — 8.9.19+2
▶NVDdrupal/drupal8.0.0 — 8.9.19+2
▶Packagistdrupal/graphql4.0.0 — 4.2.0

Patches

Patch: www.drupal.org ↗Patch: www.drupal.org ↗

🔴Vulnerability Details

6
GHSA
Unrestricted Upload of File with Dangerous Type in Drupal core↗2022-02-12
▶
OSV
Unrestricted Upload of File with Dangerous Type in Drupal core↗2022-02-12
▶
CVEList
CVE-2020-13675: Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs↗2022-02-11
▶
OSV
CVE-2020-13675: Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs↗2022-02-11
▶
OSV
CVE-2020-13675: This advisory addresses a similar issue to [Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008](https://www↗2021-09-15
▶

📋Vendor Advisories

2
Drupal
Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008↗2021-09-15
▶
Drupal
GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029↗2021-09-15
▶
CVE-2020-13675 — Improper Access Control in Drupal Core | cvebase