Description

Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.

Remediation

References

CVE-2020-13677

Related Vulnerabilities

WordPress Plugin SlideDeck 2 Lite Responsive Content Slider Local/Remote File Inclusion (2.3.3)

PHP Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2023-0568)

Apache Tomcat CVE-2019-2684 Vulnerability (CVE-2019-2684)

WordPress Plugin Developer Tools Arbitrary File Upload (1.1.4)

PrestaShop Exposure of Private Personal Information to an Unauthorized Actor Vulnerability (CVE-2025-51586)

Severity

High

Classification

CVE-2020-13677 CWE-284 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities