CVE-2020-13677: Drupal core access bypass vulnerability
Drupal core access bypass vulnerability
Other sources
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 9.2.6 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 9.1.13 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.9.19
Event History
Frequently Asked Questions
What is CVE-2020-13677?
CVE-2020-13677 is a vulnerability in the Drupal core JSON:API module that can result in unintended access bypass.
Which sites are affected by CVE-2020-13677?
Sites that have the Drupal core JSON:API module enabled and are running versions between 8.0.0 and 8.9.19, 9.1.0 and 9.1.13, or 9.2.0 and 9.2.6 are affected.
What is the severity of CVE-2020-13677?
CVE-2020-13677 has a severity rating of 7.5, which is considered high.
How can I fix CVE-2020-13677?
To fix CVE-2020-13677, Drupal site owners should update the JSON:API module to version 8.9.19, 9.1.13, or 9.2.6, depending on the version being used.
Where can I find more information about CVE-2020-13677?
You can find more information about CVE-2020-13677 on the National Vulnerability Database (NVD), Drupal's security advisory, and the GitHub commit.