PT-2020-13648 · Drupal · Drupal Core

Andrei Mateescu · Published 2020-09-16 · Updated 2024-03-06 · CVE-2020-13667

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal Core versions prior to 8.8.10 Drupal Core versions prior to 8.9.6 Drupal Core versions prior to 9.0.6

Description The issue is an access bypass vulnerability in the Workspaces module of Drupal Core, which fails to properly check access permissions when switching workspaces. This could allow an attacker to access data without the correct permissions, potentially viewing content before it is intended to be seen. The vulnerability is mitigated by the fact that only sites with the experimental Workspaces module installed are affected.

Recommendations For versions prior to 8.8.10, update to version 8.8.10 or later. For versions prior to 8.9.6, update to version 8.9.6 or later. For versions prior to 9.0.6, update to version 9.0.6 or later.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BIT-DRUPAL-2020-13667

CVE-2020-13667

DRUPAL-CORE-2020-008

GHSA-X2Q9-R8GM-F657

Affected Products

Drupal Core

References · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13667.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13667.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-x2q9-r8gm-f657 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13667 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-drupal-2020-13667 · Vendor Advisory
• https://drupal.org/sa-core-2020-008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13667 · Security Note
• https://github.com/drupal/core · Note
• https://t.me/thehackernews/845 · Telegram Post