CVE-2020-13665

CRITICAL9.8EPSS 0.58%

Drupal Core Access bypass vulnerability

發布日:2022/5/24修改日:2025/4/3

也稱為:GHSA-wxqp-jwc9-g39xBIT-drupal-2020-13665

描述

Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1.

受影響套件(3)

Bitnami/drupal>= 8.8.0, < 8.8.8, >= 8.9.0, < 8.9.1, >= 9.0.0, < 9.0.1
Packagist/drupal/core>= 8.8.0, < 8.8.8
Packagist/drupal/drupal>= 8.8.0, < 8.8.8

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-13665
PATCHhttps://github.com/drupal/core
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13665.yaml
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13665.yaml
WEBhttps://www.drupal.org/sa-core-2020-006