GHSA-j586-cj67-vg4p
Cross-Site Request Forgery in Drupal core
At a glance
- Published
- Updated
- CVE
- CVE-2020-13674
- Aliases
- BIT-drupal-2020-13674, DRUPAL-CORE-2021-007
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Description
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
Affected packages
| Package | Versions |
|---|---|
| Packagist · drupal/core | introduced 8.0.0, fixed 8.9.19 |
| Packagist · drupal/core | introduced 9.1.0, fixed 9.1.13 |
| Packagist · drupal/core | introduced 9.2.0, fixed 9.2.6 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-13674 ADVISORY
- https://github.com/drupal/core/commit/20cd85db8198c63101bd050ea973b13f2f3edef6 WEB
- https://github.com/drupal/core/commit/6359b3ea5aacf85399285c522c6d787a218c897c WEB
- https://github.com/drupal/core/commit/801910fcdfc14ee6120051089a2129e455186ad8 WEB
- https://github.com/drupal/core PACKAGE
- https://www.drupal.org/sa-core-2021-007 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |