CVE-2020-13675

Name

CVE-2020-13675

Description

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

NVD Severity

high

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:drupal:drupal::::::::`	drupal	>= 8.0.0	< 8.9.19
`cpe:2.3:a:drupal:drupal::::::::`	drupal	>= 9.1.0	< 9.1.13
`cpe:2.3:a:drupal:drupal::::::::`	drupal	>= 9.2.0	< 9.2.6

References

Match rules

Vulnerable and fixed packages