Vulnerability advisory
CVE-2020-13677
Also known as BIT-drupal-2020-13677DRUPAL-CORE-2021-010GHSA-3xr3-phjp-g6p2
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/drupal/drupal ↗ | |
| 35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before ff4f28f15d717b1ba39867f1550a248d1a915928 | ff4f28f15d717b1ba39867f1550a248d1a915928 |
| 5c6f14f762c9aef87cd2731818386f202ee8463c to before bdafd0207e0b6d78baa13ac181d9b74ba5e806cd | bdafd0207e0b6d78baa13ac181d9b74ba5e806cd |
| 943ecef3c0bc9822338252a7df6419aeb9253c9d to before 4d4e64ff19e7fefad760f223bdb8cf36db9db43e | 4d4e64ff19e7fefad760f223bdb8cf36db9db43e |
Also listed as affected (32)
| |
Description
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.