CVE-2020-13664

Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1.

CVSS v3 8.8 HIGH
CVSS v2.0 9.3 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.drupal.org/sa-core-2020-005	Vendor Advisory
https://www.drupal.org/sa-core-2020-005	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:drupal:drupal::::::::
	cpe:2.3:a:drupal:drupal::::::::
	cpe:2.3:a:drupal:drupal::::::::

History

21 Nov 2024, 05:01

Type	Values Removed	Values Added
References	~~() https://www.drupal.org/sa-core-2020-005 - Vendor Advisory~~	() https://www.drupal.org/sa-core-2020-005 - Vendor Advisory

Information

Published : 2021-05-05 15:15

Updated : 2024-11-21 05:01

NVD link : CVE-2020-13664

Mitre link : CVE-2020-13664

CVE.ORG link : CVE-2020-13664

JSON object : View

Products Affected

drupal

drupal

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2020-13664", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-05-05T15:15:08.227", "references": [{"url": "https://www.drupal.org/sa-core-2020-005", "tags": ["Vendor Advisory"], "source": "mlhess@drupal.org"}, {"url": "https://www.drupal.org/sa-core-2020-005", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1."}, {"lang": "es", "value": "Una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo PHP arbitraria en Drupal Core bajo determinadas circunstancias. Un atacante podr\u00eda enga\u00f1ar a un administrador de visitar un sitio malicioso que podr\u00eda resultar en la creaci\u00f3n de un directorio cuidadosamente nombrado en el sistema de archivos. Con este directorio en su lugar, un atacante podr\u00eda intentar mediante fuerza bruta una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo remota. Es m\u00e1s probable que los servidores de Windows est\u00e9n afectados. Este problema afecta a: Drupal Drupal Core versiones 8.8.x anteriores a 8.8.8; Versiones 8.9.x anteriores a 8.9.1; versiones 9.0.1 anteriores a 9.0.1"}], "lastModified": "2024-11-21T05:01:43.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66FFE610-B1FE-4177-9895-947CD43B9E97", "versionEndExcluding": "8.8.8", "versionStartIncluding": "8.8.0"}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D615108-F4BB-4245-8A07-59FBE362B364", "versionEndExcluding": "8.9.1", "versionStartIncluding": "8.9.0"}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B108358-A0B2-44BC-8D3E-9AECEA14E3BE", "versionEndExcluding": "9.0.1", "versionStartIncluding": "9.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "mlhess@drupal.org"}