CVE-2020-13671 : Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

Published 2020-11-20 16:15:15

Updated 2022-01-01 18:19:18

Source Drupal.org

View at NVD, CVE.org

CVE-2020-13671 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Drupal core Un-restricted Upload of File

CISA required action:

Apply updates per vendor instructions.

CISA description:

Improper sanitization in the extension file names is present in Drupal core.

Added on 2022-01-18 Action due date 2022-07-18

Exploit prediction scoring system (EPSS) score for CVE-2020-13671

Probability of exploitation activity in the next 30 days: 1.24%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 84 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2020-13671

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-13671

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-13671

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/

Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/

Mailing List;Third Party Advisory

CVEs referencing this url
https://www.drupal.org/sa-core-2020-012

Drupal core - Critical - Remote code execution - SA-CORE-2020-012 | Drupal.org
Vendor Advisory

Products affected by CVE-2020-13671