← Back

CVE-2020-13675

nvd nist
Published: Feb 11, 2022Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

Affected (3)

Products: Drupal: Drupal
Drupal
1 product
Drupal
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Drupal
Drupal
From 8.0.0 to 8.9.19
Drupal
From 9.1.0 to 9.1.13
Drupal
From 9.2.0 to 9.2.6

Related CWEs

CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

Source: mlhess@drupal.org
MitigationPatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationPatchVendor Advisory

Timeline

No history available yet.