CVE-2020-13670
mediumPriorität · verfolgen · 30EPSS 0.011 · 66. PerzentilEUUSEPSS · bewertet 2026-10-27
Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (15)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-mmjr-5q74-p3m4Exposure of Resource to Wrong Sphere in Drupal Core2022-02-12ghsa · osvUS
Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
- BIT-drupal-2020-136702024-03-06vendor · osvUS
Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
- DRUPAL-CORE-2020-0112020-09-16vendor · osvUS
A vulnerability exists in the File module which allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202009-1023cnnvd
- EUVD-2022-1104enisa_euvd
- GHSA-mmjr-5q74-p3m4enisa_euvd
- BIT-drupal-2020-13670osv
- DRUPAL-CORE-2020-011osv
- GHSA-mmjr-5q74-p3m4osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2020-13670cnnvd
- https://vigilance.fr/vulnerability/Drupal-Core-information-disclosure-via-File-Module-33351cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.3175/cnnvd
- https://www.drupal.org/sa-core-2020-011cnnvd
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connects-developer-portal-is-impacted-by-multiple-vulnerabilities-in-drupal-core/cnnvd
- https://www.drupal.org/sa-core-2020-011enisa_euvd
- https://www.drupal.org/sa-core-2020-011PatchVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan