Vulnerability advisory
CVE-2020-13676
Also known as BIT-drupal-2020-13676DRUPAL-CORE-2021-009GHSA-qfhg-m6r8-xxpj
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/drupal/drupal ↗ | |
| a412ca41cfc0d954fe3cb2dd982dc6ca049b1c70 to before ff4f28f15d717b1ba39867f1550a248d1a915928 | ff4f28f15d717b1ba39867f1550a248d1a915928 |
| 5c6f14f762c9aef87cd2731818386f202ee8463c to before bdafd0207e0b6d78baa13ac181d9b74ba5e806cd | bdafd0207e0b6d78baa13ac181d9b74ba5e806cd |
| 943ecef3c0bc9822338252a7df6419aeb9253c9d to before 4d4e64ff19e7fefad760f223bdb8cf36db9db43e | 4d4e64ff19e7fefad760f223bdb8cf36db9db43e |
Also listed as affected (26)
| |
Description
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.