CVE-2020-13667: drupal

csirt@kutim:~/threat-intel/cve/CVE-2020-13667

CVSS 5.3 · Medium EPSS 0,93%

Kerentanan Incorrect Default Permissions pada drupal. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.

Rincian

Terbit di NVD: 17 Mei 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-276: Incorrect Default Permissions
EPSS (30 hari): 0,93% peluang dieksploitasi; lebih tinggi dari 59,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
drupal	drupal	Versi 8.8.0 hingga sebelum 8.8.10
drupal	drupal	Versi 8.9.0 hingga sebelum 8.9.6
drupal	drupal	Versi 9.0.0 hingga sebelum 9.0.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.drupal.org/sa-core-2020-008 patch · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.