PT-2022-8501 · Quickedit · Quickedit

CVE-2020-13674 · Published 2022-02-11 · Updated 2024-03-06

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions QuickEdit module (affected versions not specified)

Description The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module is installed. Removing the access in-place editing permission from untrusted users will not fully mitigate the issue.

Recommendations For the QuickEdit module, consider removing or restricting the module until a proper fix is available. As a temporary workaround, restrict access to the QuickEdit module to trusted users only. Avoid granting the access in-place editing permission to untrusted users, as this does not fully mitigate the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BIT-DRUPAL-2020-13674

CVE-2020-13674

DRUPAL-CORE-2021-007

GHSA-J586-CJ67-VG4P

Affected Products

Quickedit

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2020-13674 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-13674 · Security Note
• https://osv.dev/vulnerability/BIT-drupal-2020-13674 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13674 · Vendor Advisory
• https://drupal.org/sa-core-2021-007 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13674 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13674 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j586-cj67-vg4p · Vendor Advisory
• https://github.com/drupal/core · Note
• https://github.com/drupal/core/commit/20cd85db8198c63101bd050ea973b13f2f3edef6 · Note
• https://github.com/drupal/core/commit/6359b3ea5aacf85399285c522c6d787a218c897c · Note
• https://github.com/drupal/core/commit/801910fcdfc14ee6120051089a2129e455186ad8 · Note
• https://t.me/cvenotify/26971 · Telegram Post