CVE-2020-13667: Medium severity Drupal Drupal vulnerability
Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
Other sources
Drupal core - Moderately critical - Access bypass - SA-CORE-2020-008
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-13667?
CVE-2020-13667 is an access bypass vulnerability in Drupal Core Workspaces that allows an attacker to access data without correct permissions.
What is the severity of CVE-2020-13667?
The severity of CVE-2020-13667 is moderately critical with a CVSS score of 5.3.
How does CVE-2020-13667 affect Drupal?
CVE-2020-13667 affects Drupal versions 8.0.0 to 8.9.6 and 9.0.0 to 9.0.6.
How can an attacker exploit CVE-2020-13667?
An attacker can exploit CVE-2020-13667 by leveraging the access bypass vulnerability in the Workspaces module to view content without proper permissions.
Where can I find more information about CVE-2020-13667?
More information about CVE-2020-13667 can be found at the following link: [SA-CORE-2020-008](https://www.drupal.org/sa-core-2020-008)