Access Bypass Vulnerability in Drupal Core by Drupal
CVE-2020-13665

9.8CRITICAL

Key Information:

Vendor
Drupal
Status
Drupal Core
Vendor
CVE Published:
5 May 2021

Summary

An access bypass vulnerability in Drupal Core exists when JSON:API operates in read/write mode without appropriate configurations. Specifically, only sites with the 'read_only' setting configured to FALSE under jsonapi.settings are at risk. This flaw allows unauthorized access to certain API resources, potentially exposing sensitive data. It affects multiple versions of Drupal Core, necessitating updates to ensure the security and integrity of web applications running on this platform.

Affected Version(s)

Drupal Core 8.8.x < 8.8.8

Drupal Core 8.9.x < 8.9.1

Drupal Core 9.0.x < 9.0.1

References

https://www.drupal.org/sa-core-2020-006
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.