Vulnerability advisory
BIT-drupal-2020-13674
Also known as CVE-2020-13674DRUPAL-CORE-2021-007GHSA-j586-cj67-vg4p
Severity
Severity not reported.
Affected versions
drupal Bitnami
| Affected | Fixed in |
|---|---|
8.9.0 to before 8.9.19 | 8.9.19 |
9.1.0 to before 9.1.13 | 9.1.13 |
9.2.0 to before 9.2.6 | 9.2.6 |
Severity for this package
| |
Description
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.