CVE-2020-13663: Cross Site Request Forgery vulnerability in Drupal Core Form API
Summary
CVE-2020-13663: Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities. Affects drupal across 4 version ranges.
>= 7.0.0, < 7.72.0
>= 8.8.0, < 8.8.8
>= 8.9.0, < 8.9.1
>= 9.0.0, < 9.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal/core · Packagist
The same CVE-2020-13663 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible framework for building websites and applications. The Form API is a key component of Drupal that allows developers to create and handle forms. This vulnerability affects versions 7.0.0 and above of Drupal, including Bitnami's Drupal package.
Vulnerability Detail
The Form API in Drupal Core does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities. This vulnerability allows an attacker to forge requests on behalf of authenticated users, potentially leading to unauthorized actions or data manipulation. The impact of this vulnerability can be severe, as it can be leveraged to exploit other vulnerabilities or compromise the integrity and confidentiality of the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.72.07.72.0 -
>= 8.8.0, < 8.8.88.8.8 -
>= 8.9.0, < 8.9.18.9.1 -
>= 9.0.0, < 9.0.19.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating Drupal Core or Bitnami's Drupal package.
Conclusion
The Cross Site Request Forgery vulnerability in Drupal Core Form API can have severe consequences, allowing attackers to forge requests and potentially exploit other vulnerabilities. It is crucial to update Drupal Core or Bitnami's Drupal package to the recommended versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal →
FAQ
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible framework for building websites and applications.
The Form API is a key component of Drupal that allows developers to create and handle forms.
Cross-site request forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In the context of this vulnerability, it refers to the ability of an attacker to forge requests on behalf of authenticated users.
This vulnerability can lead to unauthorized actions or data manipulation, potentially compromising the integrity and confidentiality of the affected system. It can also be leveraged to exploit other vulnerabilities.
You can use Vulert's playground at Vulert Scanner to check if your Drupal installation is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time monitoring and alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
