GitHub Advisoryadvisory · Packagist

GHSA-wxqp-jwc9-g39x Drupal Core Access bypass vulnerability

CRITICAL Published 2022-05-24 Modified 2024-04-23 Official page ↗
Aliases
CVE-2020-13665
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863
Reviewed
2024-04-23

Affected packages

• Packagist drupal/core: >= 8.8.0, < 8.8.8 → fixed in 8.8.8 • Packagist drupal/core: >= 8.9.0, < 8.9.1 → fixed in 8.9.1 • Packagist drupal/core: >= 9.0.0, < 9.0.1 → fixed in 9.0.1 • Packagist drupal/drupal: >= 8.8.0, < 8.8.8 → fixed in 8.8.8 • Packagist drupal/drupal: >= 8.9.0, < 8.9.1 → fixed in 8.9.1 • Packagist drupal/drupal: >= 9.0.0, < 9.0.1 → fixed in 9.0.1

Description

Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1.

Related

Alias · CVE (1)

  • CVE-2020-13665 Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References