CVE-2020-13664

2021-05-0514:56:39

drupal

www.cve.org

9.1 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.7%

JSON

Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1.

CNA Affected

[
  {
    "product": "Drupal Core",
    "vendor": "Drupal",
    "versions": [
      {
        "lessThan": "8.8.8",
        "status": "affected",
        "version": "8.8.x",
        "versionType": "custom"
      },
      {
        "lessThan": "8.9.1",
        "status": "affected",
        "version": "8.9.x",
        "versionType": "custom"
      },
      {
        "lessThan": "9.0.1",
        "status": "affected",
        "version": "9.0.1",
        "versionType": "custom"
      }
    ]
  }
]