CVEvulnerability

CVE-2020-13674

6.5 MEDIUM Published 2022-02-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-02-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-352

Description

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.

Affected configurations

• drupal drupal (>= 8.9.0 < 8.9.19) • drupal drupal (>= 9.1.0 < 9.1.13) • drupal drupal (>= 9.2.0 < 9.2.6)

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References