CVE-2020-13668

{"containers": {"cna": {"affected": [{"product": "Core", "vendor": "Drupal", "versions": [{"lessThan": "8.8.10", "status": "affected", "version": "8.8.x", "versionType": "custom"}, {"lessThan": "8.9.6", "status": "affected", "version": "8.9.x", "versionType": "custom"}, {"lessThan": "9.0.6", "status": "affected", "version": "9.0.x", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6."}], "problemTypes": [{"descriptions": [{"description": "Access Bypass", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-02-11T15:15:14.000Z", "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.drupal.org/sa-core-2020-009"}], "source": {"discovery": "UNKNOWN"}, "title": "Access bypass in Drupal Core 8/9", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@drupal.org", "ID": "CVE-2020-13668", "STATE": "PUBLIC", "TITLE": "Access bypass in Drupal Core 8/9"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Core", "version": {"version_data": [{"version_affected": "<", "version_name": "8.8.x", "version_value": "8.8.10"}, {"version_affected": "<", "version_name": "8.9.x", "version_value": "8.9.6"}, {"version_affected": "<", "version_name": "9.0.x", "version_value": "9.0.6"}]}}]}, "vendor_name": "Drupal"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Access Bypass"}]}]}, "references": {"reference_data": [{"name": "https://www.drupal.org/sa-core-2020-009", "refsource": "CONFIRM", "url": "https://www.drupal.org/sa-core-2020-009"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T12:25:16.423Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.drupal.org/sa-core-2020-009"}]}]}, "cveMetadata": {"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "assignerShortName": "drupal", "cveId": "CVE-2020-13668", "datePublished": "2022-02-11T15:15:14.000Z", "dateReserved": "2020-05-28T00:00:00.000Z", "dateUpdated": "2024-08-04T12:25:16.423Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Core", "vendor": "Drupal", "versions": [{"lessThan": "8.8.10", "status": "affected", "version": "8.8.x", "versionType": "custom"}, {"lessThan": "8.9.6", "status": "affected", "version": "8.9.x", "versionType": "custom"}, {"lessThan": "9.0.6", "status": "affected", "version": "9.0.x", "versionType": "custom"}]}], "source": "mlhess@drupal.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE1FFB12-D51C-4248-AF0C-AC888E902464", "versionEndExcluding": "8.8.10", "versionStartIncluding": "8.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "0716C15A-CA54-446C-9ED2-7B620719C68C", "versionEndExcluding": "8.9.6", "versionStartIncluding": "8.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "B2579140-7CB7-4F05-8FF8-C04E0E486AD5", "versionEndExcluding": "9.0.6", "versionStartIncluding": "9.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6."}, {"lang": "es", "value": "Una vulnerabilidad de Omisi\u00f3n de Acceso en Drupal Core permite que un atacante aproveche la forma en que es renderizado el HTML de los formularios afectados para explotar la vulnerabilidad. Este problema afecta a: Drupal Core versiones 8.8.x anteriores a 8.8.10; versiones 8.9.x anteriores a 8.9.6; versiones 9.0.x anteriores a 9.0.6"}], "id": "CVE-2020-13668", "lastModified": "2026-06-17T02:53:32.550", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-02-11T16:15:08.020", "references": [{"source": "mlhess@drupal.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.drupal.org/sa-core-2020-009"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.drupal.org/sa-core-2020-009"}], "sourceIdentifier": "mlhess@drupal.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}