What is GHSA-qfhg-m6r8-xxpj?

GHSA-qfhg-m6r8-xxpj is a security advisory published by GitHub Security Advisories with Medium severity. Incorrect Authorization in Drupal core

Which CVE IDs does GHSA-qfhg-m6r8-xxpj cover?

GHSA-qfhg-m6r8-xxpj covers the following CVE IDs: CVE-2020-13676. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qfhg-m6r8-xxpj?

GHSA-qfhg-m6r8-xxpj has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-qfhg-m6r8-xxpj?

GHSA-qfhg-m6r8-xxpj affects 3 products, including: composer/drupal/core:\u003e= 9.1.0, \u003c 9.1.13; composer/drupal/core:\u003e= 9.2.0, \u003c 9.2.6; composer/drupal/core:\u003e= 8.0.0, \u003c 8.9.19.

GHSA-qfhg-m6r8-xxpjMediumCVSS 6.5

Incorrect Authorization in Drupal core

Vendor

GitHub Security Advisories

Published

February 12, 2022

Last Modified

October 10, 2023

🔗 CVE IDs covered (1)

CVE-2020-13676 →

📋 Description

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

🎯 Affected products3

composer/drupal/core:>= 9.1.0, < 9.1.13
composer/drupal/core:>= 9.2.0, < 9.2.6
composer/drupal/core:>= 8.0.0, < 8.9.19

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-13676
https://www.drupal.org/sa-core-2021-009
https://github.com/drupal/core/commit/8e8e3d2ddd72471ba886346ecabfb5d98fd27d9b
https://github.com/advisories/GHSA-qfhg-m6r8-xxpj