Drupal Core
At a glance
- Source
- NVD
- EPSS
- EPSS 1.39 % · percentile 72 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- drupal
- NVD status
- Modified
Description
Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- DRUPAL-CONTRIB-2021-029 — This advisory addresses a similar issue to [Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008](https://www.drupal.org/sa-core-2021-008).
- DRUPAL-CORE-2021-008 — Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access
- GHSA-v8wr-r69p-mmwx — Unrestricted Upload of File with Dangerous Type in Drupal core
European references
- ENISA EUVD · EUVD-2022-1196
- GCVE · GCVE-0-2020-13675
CERT-FR advisories
- CERTFR-2021-AVI-712 — Multiples vulnérabilités dans Drupal Core · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.9.19cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 9.1.0 < 9.1.13cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 9.2.0 < 9.2.6
Affected products
| Product | Versions |
|---|---|
| Drupal · Core | affected 9.2.x < 9.2.6 ; affected 9.1.x < 9.1.13 ; affected 8.9.x < 8.9.19 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |