Description

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

Remediation

References

CVE-2020-13675

Related Vulnerabilities

PHP Improper Input Validation Vulnerability (CVE-2011-1470)

WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2019-10086)

Joomla CVE-2012-0835 Vulnerability (CVE-2012-0835)

PrestaShop Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2023-39525)

Drupal Improper Authentication Vulnerability (CVE-2019-10911)

Severity

Critical

Classification

CVE-2020-13675 CWE-434 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities