CVE-2020-13664 | Date: (C)2021-05-06 (M)2023-12-22 |
Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1.
CVSS Score and Metrics +CVSS Score and Metrics -CVSS V3 Severity: | CVSS V2 Severity: |
CVSS Score : 8.8 | CVSS Score : 9.3 |
Exploit Score: 2.8 | Exploit Score: 8.6 |
Impact Score: 5.9 | Impact Score: 10.0 |
|
CVSS V3 Metrics: | CVSS V2 Metrics: |
Attack Vector: NETWORK | Access Vector: NETWORK |
Attack Complexity: LOW | Access Complexity: MEDIUM |
Privileges Required: NONE | Authentication: NONE |
User Interaction: REQUIRED | Confidentiality: COMPLETE |
Scope: UNCHANGED | Integrity: COMPLETE |
Confidentiality: HIGH | Availability: COMPLETE |
Integrity: HIGH | |
Availability: HIGH | |
| |