CVE-2020-13665
CVE-2020-13665
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1.
CVSS 9.8 · Critical · EPSS 1.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
drupal core
- Versions
- ≥ 8.8.x, < 8.8.8: Affected (custom)
- ≥ 8.9.x, < 8.9.1: Affected (custom)
- ≥ 9.0.x, < 9.0.1: Affected (custom)
Update to 8.8.8; Update to 8.9.1; Update to 9.0.1
drupal/core Packagist
- Versions
- 8.8.0
- 8.8.1
- 8.8.2
- 8.8.3
- 8.8.4
- 8.8.5
- 8.8.6
- 8.8.7
- Affected ranges
- ECOSYSTEM: ≥ 8.8.0, < 8.8.8
Update to 8.8.8
drupal/core Packagist
- Versions
- 8.9.0
- Affected ranges
- ECOSYSTEM: ≥ 8.9.0, < 8.9.1
Update to 8.9.1
drupal/core Packagist
- Versions
- 9.0.0
- Affected ranges
- ECOSYSTEM: ≥ 9.0.0, < 9.0.1
Update to 9.0.1
drupal/drupal Packagist
- Versions
- 8.8.0
- 8.8.1
- 8.8.2
- 8.8.3
- 8.8.4
- 8.8.5
- 8.8.6
- 8.8.7
- Affected ranges
- ECOSYSTEM: ≥ 8.8.0, < 8.8.8
Update to 8.8.8
drupal/drupal Packagist
- Versions
- 8.9.0
- Affected ranges
- ECOSYSTEM: ≥ 8.9.0, < 8.9.1
Update to 8.9.1
drupal/drupal Packagist
- Versions
- 9.0.0
- Affected ranges
- ECOSYSTEM: ≥ 9.0.0, < 9.0.1
Update to 9.0.1