CVE-2020-13677

2022-02-1115:55:12

CWE-284

drupal

www.cve.org

8.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.6%

JSON

Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.

CNA Affected

[
  {
    "product": "Core",
    "vendor": "Drupal",
    "versions": [
      {
        "lessThan": "9.2.6",
        "status": "affected",
        "version": "9.2.x",
        "versionType": "custom"
      },
      {
        "lessThan": "9.1.13",
        "status": "affected",
        "version": "9.1.x",
        "versionType": "custom"
      },
      {
        "lessThan": "8.9.19",
        "status": "affected",
        "version": "8.9.x",
        "versionType": "custom"
      }
    ]
  }
]