Description

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

Remediation

References

CVE-2020-13675

Related Vulnerabilities

WordPress Plugin WP Sitemap Page Cross-Site Scripting (1.6.4)

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-36398)

WordPress Plugin Spiffy XSPF Player SQL Injection (0.1)

Oracle Application Server CVE-2006-3711 Vulnerability (CVE-2006-3711)

WordPress Plugin Ultimate FAQ Security Bypass (1.8.24)

Severity

Critical

Classification

CVE-2020-13675 CWE-434 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities