PT-2020-13650 · Drupal · Drupal Core

Published 2020-09-16 · Updated 2024-03-06 · CVE-2020-13670

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal Core versions prior to 8.8.10 Drupal Core versions prior to 8.9.6 Drupal Core versions prior to 9.0.6

Description The issue allows an attacker to gain access to the file metadata of a permanent private file by guessing the ID of the file. This is an Information Disclosure issue in the file module of Drupal Core.

Recommendations For versions prior to 8.8.10, update to version 8.8.10 or later. For versions prior to 8.9.6, update to version 8.9.6 or later. For versions prior to 9.0.6, update to version 9.0.6 or later.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BIT-DRUPAL-2020-13670

CVE-2020-13670

DRUPAL-CORE-2020-011

GHSA-MMJR-5Q74-P3M4

Affected Products

Drupal Core

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13670.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13670.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2020-13670 · Vendor Advisory
• https://drupal.org/sa-core-2020-011 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13670 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13670 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mmjr-5q74-p3m4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13670 · Security Note
• https://osv.dev/vulnerability/BIT-drupal-2020-13670 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13670 · Vendor Advisory
• https://github.com/drupal/core · Note
• https://github.com/drupal/core/commit/f93a37b713b59f8d24e826bc74378099853eef3d · Note
• https://t.me/thehackernews/845 · Telegram Post