CVE-2020-13676
published 2022-02-11CVE-2020-13676: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only…
PriorityP434medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.79%
51.7th percentile
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| drupal | core | >= 8.0.0 < 8.9.19 | 8.9.19 |
| drupal | core | >= 8.9 < 8.9.19 | 8.9.19 |
| drupal | core | >= 9.1 < 9.1.13 | 9.1.13 |
| drupal | core | >= 9.1.0 < 9.1.13 | 9.1.13 |
| drupal | core | >= 9.2 < 9.2.6 | 9.2.6 |
| drupal | core | >= 9.2.0 < 9.2.6 | 9.2.6 |
| drupal | drupal | >= 8.9.0 < 8.9.19 | 8.9.19 |
| drupal | drupal | >= 9.1.0 < 9.1.13 | 9.1.13 |
| drupal | drupal | >= 9.2.0 < 9.2.6 | 9.2.6 |
| drupal | drupal_core | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
osv6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Incorrect Authorization in Drupal core
ghsa·2022-02-12
CVE-2020-13676 [MEDIUM] CWE-284 Incorrect Authorization in Drupal core
Incorrect Authorization in Drupal core
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
OSV
Incorrect Authorization in Drupal core
osv·2022-02-12
CVE-2020-13676 [MEDIUM] Incorrect Authorization in Drupal core
Incorrect Authorization in Drupal core
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
OSV
CVE-2020-13676: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data
osv·2022-02-11·CVSS 6.5
CVE-2020-13676 [MEDIUM] CVE-2020-13676: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
OSV
CVE-2020-13676: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data
osv·2021-09-15
CVE-2020-13676 CVE-2020-13676: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.
Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
This advisory is not covered by [Drupal Steward](/steward).
Drupal
Drupal core - Moderately critical - Access bypass - SA-CORE-2021-009
vendor_drupal·2021-09-15
CVE-2020-13676 [MEDIUM] Drupal core - Moderately critical - Access bypass - SA-CORE-2021-009
Title: Drupal core - Moderately critical - Access bypass - SA-CORE-2021-009
Vulnerability Type: Access bypass
Description: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. This advisory is not covered by Drupal Steward .
Solution: Install the latest version: If you are using Drupal 9.2, update to Drupal 9.2.6 . If you are using Drupal 9.1, update to Drupal 9.1.13 . If you are using Drupal 8.9, update to Drupal 8.9.19 . Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the QuickEdit module
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-02-11
Published