Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Drupal Core 8.9.19, 9.1.13, 9.2.6 Clear all filters
TI-2020-10737 CVE-2020-13677 · GHSA-3xr3-phjp-g6p2

Improper access control in Drupal Core

Priority LOW 35

Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01216 Published 2022-02-11 Fixed in 9.2.6, 9.1.13 +1 CWE-284
TI-2020-10736 CVE-2020-13676 · GHSA-qfhg-m6r8-xxpj

Improper access control in Drupal Core

Priority LOW 30

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00805 Published 2022-02-11 Fixed in 9.2.6, 9.1.13 +1 CWE-284
TI-2020-10734 CVE-2020-13674 · GHSA-j586-cj67-vg4p

Cross-site request forgery in Drupal Core

Priority LOW 29

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00456 Published 2022-02-11 Fixed in 9.2.6, 9.1.13 +1 CWE-352
TI-2020-10735 CVE-2020-13675 · GHSA-v8wr-r69p-mmwx

Improper access control in Drupal Core

Priority MEDIUM 45

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01385 Published 2022-02-11 Fixed in 9.2.6, 9.1.13 +1 CWE-284