CVE-2020-13668
Last modified
CVE-2020-13668 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.. EPSS estimates a 0.67% chance of exploitation in the next 30 days.
Description
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Drupal | Drupal | >= 8.8.0, < 8.8.10 |
| Drupal | Drupal | >= 8.9.0, < 8.9.6 |
| Drupal | Drupal | >= 9.0.0, < 9.0.6 |
References
- https://www.drupal.org/sa-core-2020-009Patch, Vendor Advisory
- https://www.drupal.org/sa-core-2020-009Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-13668?
How severe is CVE-2020-13668?
How do I fix CVE-2020-13668?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-13662Open Redirect vulnerability in Drupal Core allows a user to …6.1
- CVE-2020-13663Cross Site Request Forgery vulnerability in Drupal Core Form…8.8
- CVE-2020-13664Arbitrary PHP code execution vulnerability in Drupal Core un…8.8
- CVE-2020-13665Access bypass vulnerability in Drupal Core allows JSON:API w…9.8
- CVE-2020-13666Cross-site scripting vulnerability in Drupal Core. Drupal AJ…6.1
- CVE-2020-13667Access bypass vulnerability in of Drupal Core Workspaces all…5.3
- CVE-2020-13669Cross-site Scripting (XSS) vulnerability in ckeditor of Drup…6.1
- CVE-2020-1367An information disclosure vulnerability exists when the Wind…5.5
- CVE-2020-13670Information Disclosure vulnerability in file module of Drupa…7.5
- CVE-2020-13671Drupal core does not properly sanitize certain filenames on …8.8
- CVE-2020-13672Cross-site Scripting (XSS) vulnerability in Drupal core's sa…6.1
- CVE-2020-13673The Entity Embed module provides a filter to allow embedding…6.1
Are you affected by CVE-2020-13668?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST