{"id":"GHSA-wxqp-jwc9-g39x","aliases":["BIT-drupal-2020-13665","CVE-2020-13665"],"title":"Drupal Core Access bypass vulnerability","description":"Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1.","severity":"critical","score":9.8,"published":"2022-05-24T17:49:27.000Z","modified":"2024-04-23T22:58:56.494Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"drupal/core","ranges":[{"events":[{"introduced":"8.8.0"},{"fixed":"8.8.8"}],"type":"ECOSYSTEM"}],"versions":["8.8.0","8.8.1","8.8.2","8.8.3","8.8.4","8.8.5","8.8.6","8.8.7"],"fixed":["8.8.8"]},{"ecosystem":"Packagist","name":"drupal/core","ranges":[{"events":[{"introduced":"8.9.0"},{"fixed":"8.9.1"}],"type":"ECOSYSTEM"}],"versions":["8.9.0"],"fixed":["8.9.1"]},{"ecosystem":"Packagist","name":"drupal/core","ranges":[{"events":[{"introduced":"9.0.0"},{"fixed":"9.0.1"}],"type":"ECOSYSTEM"}],"versions":["9.0.0"],"fixed":["9.0.1"]},{"ecosystem":"Packagist","name":"drupal/drupal","ranges":[{"events":[{"introduced":"8.8.0"},{"fixed":"8.8.8"}],"type":"ECOSYSTEM"}],"versions":["8.8.0","8.8.1","8.8.2","8.8.3","8.8.4","8.8.5","8.8.6","8.8.7"],"fixed":["8.8.8"]},{"ecosystem":"Packagist","name":"drupal/drupal","ranges":[{"events":[{"introduced":"8.9.0"},{"fixed":"8.9.1"}],"type":"ECOSYSTEM"}],"versions":["8.9.0"],"fixed":["8.9.1"]},{"ecosystem":"Packagist","name":"drupal/drupal","ranges":[{"events":[{"introduced":"9.0.0"},{"fixed":"9.0.1"}],"type":"ECOSYSTEM"}],"versions":["9.0.0"],"fixed":["9.0.1"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-13665","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13665.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13665.yaml","https://github.com/drupal/core","https://www.drupal.org/sa-core-2020-006"],"sources":[{"name":"OSV","id":"GHSA-wxqp-jwc9-g39x","modified":"2024-04-23T22:58:56.494794Z","url":"https://osv.dev/vulnerability/GHSA-wxqp-jwc9-g39x"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}]}