GitHub Advisoryadvisory · Packagist

GHSA-3xr3-phjp-g6p2 Drupal core access bypass vulnerability

HIGH Published 2022-02-12 Modified 2023-10-04 Official page ↗
Aliases
CVE-2020-13677
Ecosystem
Packagist
Packages
drupal/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-284, CWE-863
Reviewed
2023-10-04

Affected packages

• Packagist drupal/core: >= 8.0.0, < 8.9.19 → fixed in 8.9.19 • Packagist drupal/core: >= 9.1.0, < 9.1.13 → fixed in 9.1.13 • Packagist drupal/core: >= 9.2.0, < 9.2.6 → fixed in 9.2.6

Description

Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.

Related

Alias · CVE (1)

  • CVE-2020-13677 Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in… vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-863 Incorrect Authorization weakness

References