CVE-2020-13668
MEDIUM6.1EPSS 0.22%Access bypass in Drupal Core 8/9
Published: 2/12/2022Modified: 5/20/2025
Description
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Affected packages (3)
- Bitnami/drupal>= 8.8.0, < 8.8.10, >= 8.9.0, < 8.9.6, >= 9.0.0, < 9.0.6
- Packagist/drupal/core>= 8.0.0, < 8.8.10
- Packagist/drupal/drupal>= 8.0.0, < 8.8.10
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
References (8)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-13668
- PATCHhttps://github.com/drupal/core
- WEBhttps://github.com/drupal/core/commit/3184fa4b2f3b65b44884b5e858cdc7794d34b4c8
- WEBhttps://github.com/drupal/core/commit/58330ba58d1ac6f1a0a549e8dbde8a3e094bf4fb
- WEBhttps://github.com/drupal/core/commit/d4be028d81fb6b067513d788b60c3e6fc8fbd0a2
- WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13668.yaml
- WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13668.yaml
- WEBhttps://www.drupal.org/sa-core-2020-009