CVE-2020-13671
Summary
| CVE | CVE-2020-13671 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-11-20 16:15:00 UTC |
| Updated | 2023-11-07 03:16:00 UTC |
| Description | Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74. |
Risk And Classification
EPSS: 0.043040000 probability, percentile 0.901220000 (date 2026-07-22)
CISA KEV: Listed on 2022-01-18; due 2022-07-18; ransomware use Unknown
Problem Types: CWE-434
CISA Known Exploited Vulnerability
| Vendor | Drupal |
|---|---|
| Product | Drupal core |
| Name | Drupal core Un-restricted Upload of File |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://nvd.nist.gov/vuln/detail/CVE-2020-13671 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Drupal | Drupal | All | All | All | All |
| Application | Drupal | Drupal | All | All | All | All |
| Operating System | Fedoraproject | Fedora | 32 | All | All | All |
| Operating System | Fedoraproject | Fedora | 33 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] Fedora 33 Update: drupal8-8.9.11-1.fc33 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 32 Update: drupal8-8.9.11-1.fc32 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 33 Update: drupal8-8.9.11-1.fc33 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| Drupal core - Critical - Remote code execution - SA-CORE-2020-012 | Drupal.org | CONFIRM | www.drupal.org | Vendor Advisory |
| [SECURITY] Fedora 32 Update: drupal8-8.9.11-1.fc32 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.