Drupal Core
En bref
- Source
- NVD
- EPSS
- EPSS 1.39 % · centile 72 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- drupal
- Statut NVD
- Modified
Description
Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.
Faiblesses (CWE)
- CWE-284 — Contrôle d'accès incorrect
- CWE-434 — Téléversement sans restriction d'un fichier de type dangereux
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- DRUPAL-CONTRIB-2021-029 — This advisory addresses a similar issue to [Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008](https://www.drupal.org/sa-core-2021-008).
- DRUPAL-CORE-2021-008 — Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access
- GHSA-v8wr-r69p-mmwx — Unrestricted Upload of File with Dangerous Type in Drupal core
Références européennes
- ENISA EUVD · EUVD-2022-1196
- GCVE · GCVE-0-2020-13675
Avis du CERT-FR
- CERTFR-2021-AVI-712 — Multiples vulnérabilités dans Drupal Core · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.9.19cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 9.1.0 < 9.1.13cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 9.2.0 < 9.2.6
Produits affectés
| Produit | Versions |
|---|---|
| Drupal · Core | affected 9.2.x < 9.2.6 ; affected 9.1.x < 9.1.13 ; affected 8.9.x < 8.9.19 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |