CVE-2020-13667
mediumPriorität · verfolgen · 21OT-Risiko · erhöhtEPSS 0.009 · 60. PerzentilEUUSEPSS · bewertet 2026-10-26
Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (16)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-x2q9-r8gm-f657Drupal Core Access bypass vulnerability 2022-05-24ghsa · osvUS
Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
- BIT-drupal-2020-136672024-03-06vendor · osvUS
Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
- DRUPAL-CORE-2020-0082020-09-16vendor · osvUS
The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be edited before being published to the live workspace. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202009-1019cnnvd
- EUVD-2022-5688enisa_euvd
- GHSA-x2q9-r8gm-f657enisa_euvd
- BIT-drupal-2020-13667osv
- DRUPAL-CORE-2020-008osv
- GHSA-x2q9-r8gm-f657osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2020-13667cnnvd
- https://vigilance.fr/vulnerability/Drupal-Core-privilege-escalation-via-Workspaces-Module-33348cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.3175/cnnvd
- https://www.drupal.org/sa-core-2020-008cnnvd
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connects-developer-portal-is-impacted-by-multiple-vulnerabilities-in-drupal-core/cnnvd
- https://www.drupal.org/sa-core-2020-008enisa_euvd
- https://www.drupal.org/sa-core-2020-008PatchVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan