Access bypass in Drupal Core 8/9
CVE-2020-13668

6.1MEDIUM

Key Information:

Vendor
Drupal
Status
Core
Vendor
CVE Published:
11 February 2022

Summary

Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

Affected Version(s)

Core 8.8.x < 8.8.10

Core 8.9.x < 8.9.6

Core 9.0.x < 9.0.6

References

https://www.drupal.org/sa-core-2020-009
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.