Vulnerabilitycritical
Drupal fixes three vulnerabilities, including one RCE
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-13663 | Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other… | 8.8 | <1% | ||
CVE-2020-13665+1 related CVE | Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode | 9.8 group max | 1% |
From the original article
2 min read at helpnetsecurity.com
Drupal’s security team has fixed three vulnerabilities in the popular content management system’s core, one of which (CVE-2020-13663) could be exploited to achieve remote code execution. Drupal is a free and open-source web content management system (CMS), and over a million sites run on various versions of it. The most recent stable version is 9.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.