Vulnerability CVE-2020-13676

Vulnerability Name:

CVE-2020-13676 (CCN-209483)

Assigned:

2020-05-28

Published:

2021-09-15

Updated:

2022-07-08

Summary:

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

CVSS v3 Severity:

6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): High Availibility (A): None

CVSS v2 Severity:

4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Complete Availibility (A): None

Vulnerability Type:

CWE-863

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2020-13676

Source: XF
Type: UNKNOWN
drupal-core-cve202013676-sec-bypass(209483)

Source: CCN
Type: SA-CORE-2021-009
Drupal core - Moderately critical - Access bypass

Source: CONFIRM
Type: Patch, Vendor Advisory
https://www.drupal.org/sa-core-2021-009

Vulnerable Configuration:

Configuration 1:

cpe:/a:drupal:drupal:*:*:*:*:*:*:*:* (Version >= 9.2.0 and < 9.2.6)

OR cpe:/a:drupal:drupal:*:*:*:*:*:*:*:* (Version >= 9.1.0 and < 9.1.13)

OR cpe:/a:drupal:drupal:*:*:*:*:*:*:*:* (Version >= 8.9.0 and < 8.9.19)

Denotes that component is vulnerable

BACK