CSRF in Drupal Core
CVE-2020-13674
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which come…
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.001 (33.9th percentile) — read the EPSS interpretation.
Affected products
- Drupal Core — versions 9.2, 9.1, 8.9
Weakness classification (CWE)
References
- www.drupal.org/sa-core-2021-007 (x_refsource_CONFIRM)