CVE-2020-13676
Drupal Core
MEDIUM 6.5
En bref
- Source
- NVD
- EPSS
- EPSS 0.80 % · centile 57 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- drupal
- Statut NVD
- Modified
Description
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
Faiblesses (CWE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- DRUPAL-CORE-2021-009 — The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.
- GHSA-qfhg-m6r8-xxpj — Incorrect Authorization in Drupal core
Références européennes
- ENISA EUVD · EUVD-2022-1150
- GCVE · GCVE-0-2020-13676
Avis du CERT-FR
- CERTFR-2021-AVI-712 — Multiples vulnérabilités dans Drupal Core · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.9.0 < 8.9.19cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 9.1.0 < 9.1.13cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 9.2.0 < 9.2.6
Produits affectés
| Produit | Versions |
|---|---|
| Drupal · Core | affected 9.2 < 9.2.6 ; affected 9.1 < 9.1.13 ; affected 8.9 < 8.9.19 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |