Vulnerability advisory
CVE-2020-13674
Also known as BIT-drupal-2020-13674DRUPAL-CORE-2021-007GHSA-j586-cj67-vg4p
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/drupal/drupal ↗ | |
| a412ca41cfc0d954fe3cb2dd982dc6ca049b1c70 to before ff4f28f15d717b1ba39867f1550a248d1a915928 | ff4f28f15d717b1ba39867f1550a248d1a915928 |
| 5c6f14f762c9aef87cd2731818386f202ee8463c to before bdafd0207e0b6d78baa13ac181d9b74ba5e806cd | bdafd0207e0b6d78baa13ac181d9b74ba5e806cd |
| 943ecef3c0bc9822338252a7df6419aeb9253c9d to before 4d4e64ff19e7fefad760f223bdb8cf36db9db43e | 4d4e64ff19e7fefad760f223bdb8cf36db9db43e |
Also listed as affected (26)
| |
Description
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.