CVE-2020-13675

{"containers": {"cna": {"affected": [{"product": "Core", "vendor": "Drupal", "versions": [{"lessThan": "9.2.6", "status": "affected", "version": "9.2.x", "versionType": "custom"}, {"lessThan": "9.1.13", "status": "affected", "version": "9.1.x", "versionType": "custom"}, {"lessThan": "8.9.19", "status": "affected", "version": "8.9.x", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-02-11T15:45:11.000Z", "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.drupal.org/sa-core-2021-008"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@drupal.org", "ID": "CVE-2020-13675", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Core", "version": {"version_data": [{"version_affected": "<", "version_name": "9.2.x", "version_value": "9.2.6"}, {"version_affected": "<", "version_name": "9.1.x", "version_value": "9.1.13"}, {"version_affected": "<", "version_name": "8.9.x", "version_value": "8.9.19"}]}}]}, "vendor_name": "Drupal"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284 Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://www.drupal.org/sa-core-2021-008", "refsource": "CONFIRM", "url": "https://www.drupal.org/sa-core-2021-008"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T12:25:16.477Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.drupal.org/sa-core-2021-008"}]}]}, "cveMetadata": {"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "assignerShortName": "drupal", "cveId": "CVE-2020-13675", "datePublished": "2022-02-11T15:45:11.000Z", "dateReserved": "2020-05-28T00:00:00.000Z", "dateUpdated": "2024-08-04T12:25:16.477Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Core", "vendor": "Drupal", "versions": [{"lessThan": "9.2.6", "status": "affected", "version": "9.2.x", "versionType": "custom"}, {"lessThan": "9.1.13", "status": "affected", "version": "9.1.x", "versionType": "custom"}, {"lessThan": "8.9.19", "status": "affected", "version": "8.9.x", "versionType": "custom"}]}], "source": "mlhess@drupal.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "69F69CDD-9527-44F9-9A24-1CB224492E78", "versionEndExcluding": "8.9.19", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "CEDA920A-E60F-4CC8-9C06-1B3B7E200DE4", "versionEndExcluding": "9.1.13", "versionStartIncluding": "9.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED6917A0-B070-4716-9D5A-C8505254005F", "versionEndExcluding": "9.2.6", "versionStartIncluding": "9.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site."}, {"lang": "es", "value": "Los m\u00f3dulos JSON:API y REST/File de Drupal permiten la carga de archivos mediante sus APIs HTTP. Los m\u00f3dulos no ejecutan correctamente toda la comprobaci\u00f3n de los archivos, lo que causa una vulnerabilidad de omisi\u00f3n de acceso. Un atacante podr\u00eda ser capaz de subir archivos que salten el proceso de comprobaci\u00f3n de archivos implementado por los m\u00f3dulos del sitio"}], "id": "CVE-2020-13675", "lastModified": "2026-06-17T02:53:33.390", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-02-11T16:15:08.367", "references": [{"source": "mlhess@drupal.org", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://www.drupal.org/sa-core-2021-008"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://www.drupal.org/sa-core-2021-008"}], "sourceIdentifier": "mlhess@drupal.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "mlhess@drupal.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}