CVE-2020-13677
published 2022-02-11CVE-2020-13677: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.04%
59.6th percentile
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| drupal | core | >= 8.0.0 < 8.9.19 | 8.9.19 |
| drupal | core | >= 8.9.x < 8.9.19 | 8.9.19 |
| drupal | core | >= 9.1.0 < 9.1.13 | 9.1.13 |
| drupal | core | >= 9.1.x < 9.1.13 | 9.1.13 |
| drupal | core | >= 9.2.0 < 9.2.6 | 9.2.6 |
| drupal | core | >= 9.2.x < 9.2.6 | 9.2.6 |
| drupal | drupal | >= 8.0.0 < 8.9.19 | 8.9.19 |
| drupal | drupal | >= 9.1.0 < 9.1.13 | 9.1.13 |
| drupal | drupal | >= 9.2.0 < 9.2.6 | 9.2.6 |
| drupal | drupal_core | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Drupal core access bypass vulnerability
ghsa·2022-02-12
CVE-2020-13677 [HIGH] CWE-284 Drupal core access bypass vulnerability
Drupal core access bypass vulnerability
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
OSV
Drupal core access bypass vulnerability
osv·2022-02-12
CVE-2020-13677 [HIGH] Drupal core access bypass vulnerability
Drupal core access bypass vulnerability
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
OSV
CVE-2020-13677: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access
osv·2022-02-11·CVSS 7.5
CVE-2020-13677 [HIGH] CVE-2020-13677: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
OSV
CVE-2020-13677: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access
osv·2021-09-15
CVE-2020-13677 CVE-2020-13677: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass.
Sites that do not have the JSON:API module enabled are not affected.
This advisory is not covered by [Drupal Steward](/steward).
Drupal
Drupal core - Moderately critical - Access Bypass - SA-CORE-2021-010
vendor_drupal·2021-09-15
CVE-2020-13677 [MEDIUM] Drupal core - Moderately critical - Access Bypass - SA-CORE-2021-010
Title: Drupal core - Moderately critical - Access Bypass - SA-CORE-2021-010
Vulnerability Type: Access Bypass
Description: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected. This advisory is not covered by Drupal Steward .
Solution: Install the latest version: If you are using Drupal 9.2, update to Drupal 9.2.6 . If you are using Drupal 9.1, update to Drupal 9.1.13 . If you are using Drupal 8.9, update to Drupal 8.9.19 . Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the JSON:API module and therefore i
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-02-11
Published