GitHub Advisoryadvisory · Packagist

GHSA-qfhg-m6r8-xxpj Incorrect Authorization in Drupal core

MEDIUM Published 2022-02-12 Modified 2022-02-23 Official page ↗
Aliases
CVE-2020-13676
Ecosystem
Packagist
Packages
drupal/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-284, CWE-863
Reviewed
2022-02-23

Affected packages

• Packagist drupal/core: >= 8.0.0, < 8.9.19 → fixed in 8.9.19 • Packagist drupal/core: >= 9.1.0, < 9.1.13 → fixed in 9.1.13 • Packagist drupal/core: >= 9.2.0, < 9.2.6 → fixed in 9.2.6

Description

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

Related

Alias · CVE (1)

  • CVE-2020-13676 The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-863 Incorrect Authorization weakness

References