Description

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

Remediation

References

CVE-2020-13676

Related Vulnerabilities

Ruby on Rails Deserialization of Untrusted Data Vulnerability (CVE-2020-8164)

WordPress Plugin Wordfence Security-Firewall & Malware Scan Unspecified Vulnerability (5.3.2)

MySQL CVE-2019-2800 Vulnerability (CVE-2019-2800)

WordPress Plugin iPages Flipbook For WordPress Cross-Site Scripting (1.4.2)

Magento Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-21024)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-863 CVE-2020-13676