PT-2022-8502 · Drupal · Drupal

Klaus Purer · Published 2022-02-11 · Updated 2024-03-06 · CVE-2020-13675

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal (affected versions not specified)

Description The issue concerns the JSON:API and REST/File modules in Drupal, which allow file uploads through their HTTP APIs. However, these modules do not correctly run all file validation, leading to an access bypass issue. An attacker could potentially upload files that bypass the validation process implemented by other modules on the site.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Improper Access Control

Weakness Enumeration

CWE-434

CWE-284

Related Identifiers

BIT-DRUPAL-2020-13675

CVE-2020-13675

DRUPAL-CONTRIB-2021-029

DRUPAL-CORE-2021-008

GHSA-V8WR-R69P-MMWX

Affected Products

Drupal

References · 10

• https://cve.org/CVERecord?id=CVE-2020-13675 · Security Note
• https://osv.dev/vulnerability/GHSA-v8wr-r69p-mmwx · Vendor Advisory
• https://drupal.org/sa-core-2021-008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13675 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13675 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-drupal-2020-13675 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13675 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13675 · Vendor Advisory
• https://github.com/drupal/core · Note
• https://t.me/cvenotify/26972 · Telegram Post