Description
The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.
Remediation
References
Related Vulnerabilities
SharePoint Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-0920)
WordPress Plugin ProPlayer SQL Injection (4.7.9.1)
PHP Other Vulnerability (CVE-2007-1452)
WordPress Plugin BigBlueButton Cross-Site Scripting (2.2.3)
WordPress Plugin Easy PayPal Events Unspecified Vulnerability (1.1.6)