DRUPAL-CORE-2020-006

At a glance

Published: 2020-06-17 18:10 UTC
Updated: 2026-09-19 18:42 UTC
Aliases: CVE-2020-13665

Description

JSON:API PATCH requests may bypass validation for certain fields. By default, JSON:API works in a read-only mode which makes it impossible to exploit the vulnerability. Only sites that have the `read_only` set to `FALSE` under `jsonapi.settings` config are vulnerable.

Affected packages

Package	Versions
Packagist · drupal/core	introduced 8.0.0, fixed 8.8.8 ; introduced 8.9.0, fixed 8.9.1 ; introduced 9.0.0, fixed 9.0.1

References

https://www.drupal.org/sa-core-2020-006 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence