Drupal-based sites open to attack via double extension files (CVE-2020-13671)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-13671 | Unrestricted File Upload via Filename Sanitization Flaw in Drupal Core | 8.8 | 36% | KEV | KEV |
From the original article
2 min read at helpnetsecurity.com
Admins of sites running on Drupal are urged to plug a critical security hole (CVE-2020-13671) that may be exploited by attackers to take over vulnerable sites. They have also been urged to check that the vulnerability hasn’t already been covertly leveraged by attackers. CVE-2020-13671 exists because Drupal core (the standard release of Drupal) does not properly sanitize certain filenames on uploaded files.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.