drupal/core · Security
Drupal core access bypass vulnerability
- GHSA ID
- GHSA-3xr3-phjp-g6p2
- CVE ID
- CVE-2020-13677
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
CWEs
- CWE-284 · Improper Access Control
- CWE-863 · Incorrect Authorization