What is GHSA-v8wr-r69p-mmwx?

GHSA-v8wr-r69p-mmwx is a security advisory published by GitHub Security Advisories with Critical severity. Unrestricted Upload of File with Dangerous Type in Drupal core

Which CVE IDs does GHSA-v8wr-r69p-mmwx cover?

GHSA-v8wr-r69p-mmwx covers the following CVE IDs: CVE-2020-13675. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v8wr-r69p-mmwx?

GHSA-v8wr-r69p-mmwx has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-v8wr-r69p-mmwx?

GHSA-v8wr-r69p-mmwx affects 3 products, including: composer/drupal/core:\u003e= 9.1.0, \u003c 9.1.13; composer/drupal/core:\u003e= 9.2.0, \u003c 9.2.6; composer/drupal/core:\u003e= 8.0.0, \u003c 8.9.19.

GHSA-v8wr-r69p-mmwxCriticalCVSS 9.8

Unrestricted Upload of File with Dangerous Type in Drupal core

Vendor

GitHub Security Advisories

Published

February 12, 2022

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2020-13675 →

📋 Description

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

🎯 Affected products3

composer/drupal/core:>= 9.1.0, < 9.1.13
composer/drupal/core:>= 9.2.0, < 9.2.6
composer/drupal/core:>= 8.0.0, < 8.9.19

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-13675
https://www.drupal.org/sa-core-2021-008
https://github.com/advisories/GHSA-v8wr-r69p-mmwx