PT-2022-8502

CVE-2020-13675

Published

2021-09-15

Updated

2024-03-06

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal (affected versions not specified)

Description The issue concerns the JSON:API and REST/File modules in Drupal, which allow file uploads through their HTTP APIs. However, these modules do not correctly run all file validation, leading to an access bypass issue. An attacker could potentially upload files that bypass the validation process implemented by other modules on the site.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Klaus Purer

Vendors

Affected products

Weakness enumeration

CWE-434: Unrestricted Upload of File with Dangerous Type

CWE-284: Improper Access Control

Related identifiers

CVE-2020-13675

GHSA-V8WR-R69P-MMWX