VDB

CVE-2020-13671

CVE-2020-13671 PUBLISHED KEV CVSS 8.800000190734863 HIGH

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

EPSS 36.17% · 98.5th percentile

Risk Scores

CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
36.17%
98.5th percentile

Affected Products

VendorProductVersions
Bitnamidrupal7.0.0, 8.8.0, 8.9.0
Bitnamidrupal7.0.0, 8.8.0, 7.0.0

Timeline

  • Nov 18, 2020 CVE Published
  • Apr 12, 2021 VulnCheck KEV Exploitation
  • Apr 14, 2021 EPSS Score
  • Aug 24, 2021 EPSS Score
  • Dec 28, 2021 EPSS Score
  • Jan 18, 2022 CISA KEV Added
  • Jan 18, 2022 VulnCheck KEV Exploitation
  • Feb 4, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • Jul 4, 2022 EPSS Score
  • Nov 7, 2022 EPSS Score
  • Feb 14, 2023 VulnCheck KEV Exploitation

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›