CVE-2020-13671highunder attackCWE-434

CVE-2020-13671: high-severity vulnerability in Drupal Core

Published · Updated

83Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 35%
from disclosure to weapon2101 days
Published on NVDNov 20
1st PoC+2101d
CISA KEV+424d
exploitation probability
35%top 2% of all CVEs
observed exploitation
yesCISA + VulnCheck
3 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Action required by CISAfederal deadline: 2022-07-18

Apply updates per vendor instructions.

In short

Drupal doesn't properly clean up filenames when users upload files, which can trick servers into running uploaded files as PHP code or treating them as wrong file types. This could let attackers execute harmful code on the website.

Technical detail

CWE-434: Improper Restriction of Rendered UI Layers or Frames. Insufficient filename sanitization in Drupal file upload handling allows attackers to bypass MIME type validation through specially crafted filenames, leading to arbitrary PHP code execution on susceptible hosting configurations. The vulnerability affects Drupal versions prior to 9.0.8, 8.9.9, 8.8.11, and 7.74.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Drupal · Drupal Core
public PoCs found — 3
vulncheckvulncheck.com/xdb/db857382a8f2unverifiedvulncheckvulncheck.com/xdb/68dc2e5cf524unverifiedvulncheckvulncheck.com/xdb/3e3c9d30b77dunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Drupal Core

In the same product, most dangerous first.

CVE-2019-6340HIGHDrupal core - Highly critical - Remote Code ExecutionEPSS 92.0%KEVCVE-2017-6381—CVE-2017-6381EPSS 3.9%CVE-2020-13664—CVE-2020-13664EPSS 3.0%CVE-2020-13666—CVE-2020-13666EPSS 2.9%CVE-2019-6342—Drupal core - Critical - Access bypass - SA-CORE-2019-008EPSS 2.2%CVE-2017-6924—REST API can bypass comment approval - Access Bypass - Moderately CriticalEPSS 2.1%
References
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671https://www.drupal.org/sa-core-2020-012