CVE-2020-13674CWE-352

CVE-2020-13674: vulnerability in Drupal Core

Published · Updated

Follow this CVE+ Monitor Drupal core+ Monitor drupal/core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.5%
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
Affected products
Drupal · Core
Related CVEs — Drupal Core

In the same product, most dangerous first.

CVE-2022-25277HIGHCVE-2022-25277EPSS 1.4%CVE-2020-13675—CVE-2020-13675EPSS 1.4%CVE-2022-25271—CVE-2022-25271EPSS 1.3%CVE-2020-13677—CVE-2020-13677EPSS 1.2%CVE-2020-13670—CVE-2020-13670EPSS 1.1%CVE-2023-5256HIGHDrupal core - Critical - Cache poisoning - SA-CORE-2023-006EPSS 0.9%