[IT-SecNots] [Security-news] Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-core-2020-004

Project: Drupal core [1]
Date: 2020-June-17
Security risk: *Critical* 15∕25
AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross Site Request Forgery

CVE IDs: CVE-2020-13663
Description: 
The Drupal core Form API does not properly handle certain form input from
cross-site requests, which can lead to other vulnerabilities.

Solution: 
  * If you are using Drupal 7.x, upgrade to Drupal 7.72 [3].
  * If you are using Drupal 8.8.x, upgrade to Drupal 8.8.8 [4].
  * If you are using Drupal 8.9.x, upgrade to Drupal 8.9.1 [5].
  * If you are using Drupal 9.0.x, upgrade to Drupal 9.0.1 [6].

Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive
security coverage. Sites on 8.7.x or earlier should update to 8.8.8.

Reported By: 
  * Samuel Mortenson  [7] of the Drupal Security Team
  * Dor Tumarkin  [8]

Fixed By: 
  * Greg Knaddison  [9] of the Drupal Security Team
  * Samuel Mortenson  [10] of the Drupal Security Team
  * Jess   [11] of the Drupal Security Team
  * Lee Rowlands  [12] of the Drupal Security Team
  * Angie Byron  [13] of the Drupal Security Team
  * Peter Wolanin  [14] of the Drupal Security Team
  * Daniel Wehner  [15]
  * Dor Tumarkin  [16]
  * Drew Webber  [17] of the Drupal Security Team
  * Alex Pott  [18] of the Drupal Security Team
  * David Snopek  [19] of the Drupal Security Team


[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/drupal/releases/7.72
[4] https://www.drupal.org/project/drupal/releases/8.8.8
[5] https://www.drupal.org/project/drupal/releases/8.9.1
[6] https://www.drupal.org/project/drupal/releases/9.0.1
[7] https://www.drupal.org/user/2582268
[8] https://www.drupal.org/user/3648639
[9] https://www.drupal.org/user/36762
[10] https://www.drupal.org/user/2582268
[11] https://www.drupal.org/user/65776
[12] https://www.drupal.org/user/395439
[13] https://www.drupal.org/user/24967
[14] https://www.drupal.org/user/49851
[15] https://www.drupal.org/user/99340
[16] https://www.drupal.org/user/3648639
[17] https://www.drupal.org/user/255969
[18] https://www.drupal.org/user/157725
[19] https://www.drupal.org/user/266527

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news