CVE-2020-13671

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 35,4%

Kerentanan Unrestricted Upload of File with Dangerous Type pada drupal, fedoraproject fedora. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 18 Januari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

Rincian

Terbit di NVD

20 November 2020

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

35,4% peluang dieksploitasi; lebih tinggi dari 98,4% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Drupal core Un-restricted Upload of File

Masuk KEV

18 Januari 2022

Tenggat CISA

18 Juli 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.drupal.org/sa-core-2020-012 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671 pemerintah AS
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6... mailing list · release notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I... mailing list · release notes