CVE-2020-13665: Drupal Core Access bypass vulnerability
Summary
CVE-2020-13665: Drupal Core Access bypass vulnerability. Affects drupal/core across 3 version ranges.
>= 8.8.0, < 8.8.8
>= 8.9.0, < 8.9.1
>= 9.0.0, < 9.0.1
Fixed in 8.8.8, 8.9.1 or 9.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2020-13665 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal Core is a content management system (CMS) that allows users to create and manage digital content. It provides a wide range of features and functionality for building websites and web applications. The JSON:API module in Drupal Core enables developers to expose Drupal entities as JSON data. This vulnerability specifically affects sites that have the read_only configuration set to FALSE under the jsonapi.settings file.
Vulnerability Detail
The access bypass vulnerability in Drupal Core allows attackers to bypass access restrictions and perform unauthorized actions through the JSON:API when it is in read/write mode. This can lead to various security issues, such as unauthorized data modification, information disclosure, and privilege escalation. The vulnerability affects Drupal Core versions 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1, and 9.0.x prior to 9.0.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.8.0, < 8.8.88.8.8composer require drupal/core:8.8.8 -
>= 8.9.0, < 8.9.18.9.1composer require drupal/core:8.9.1 -
>= 9.0.0, < 9.0.19.0.1composer require drupal/core:9.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A temporary workaround for this vulnerability is to set the read_only configuration to TRUE under the jsonapi.settings file. This will disable write access through the JSON:API and mitigate the risk of unauthorized actions. The configuration can be updated manually or through the Drupal administration interface.
Conclusion
The access bypass vulnerability in Drupal Core can have serious security implications for affected sites. It is crucial to update Drupal Core to the patched versions and ensure the read_only configuration is set correctly. Regularly monitoring for security advisories and promptly applying updates is essential to maintain the security of Drupal-based websites and applications. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
The vulnerability affects Drupal Core versions 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1, and 9.0.x prior to 9.0.1.
The vulnerability allows attackers to bypass access restrictions and perform unauthorized actions through the JSON:API, potentially leading to data modification, information disclosure, and privilege escalation.
To fix this vulnerability, update Drupal Core to version 8.8.8, 8.9.1, or 9.0.1. Additionally, ensure that the read_only configuration is set to TRUE under the jsonapi.settings file.
Yes, a temporary workaround is to set the read_only configuration to TRUE under the jsonapi.settings file to disable write access through the JSON:API.
For more information about this vulnerability, refer to the official Drupal security advisory and the provided sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
