CISA confirmed this vulnerability is used in real attacks on 18.01.2022. Remediation deadline for US federal agencies: 18.07.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-13671
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| drupal | drupal | 7.0 – < 7.74 | |
| Drupal | Drupal Core | 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, 7 versions prior to 7.74 | |
| fedoraproject | fedora | 32 |
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 7.0 < 7.74cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 8.8.0 < 8.8.11cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 8.9.0 < 8.9.9cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 9.0.0 < 9.0.8cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.