Packagist/drupal/core CVE-2020-13674: unknown, EPSS 0.46%

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues.

Action: Upgrade drupal/core to 8.9.19 or later.

composer require drupal/core:8.9.19

composer require drupal/core:9.1.13

composer require drupal/core:9.2.6

Affected

introduced	fixed	last affected
8.0.0	8.9.19	-
9.1.0	9.1.13	-
9.2.0	9.2.6	-

Fixed versions

8.9.19

9.1.13

9.2.6

Sources

osv: DRUPAL-CORE-2021-007
https://www.drupal.org/sa-core-2021-007

CVE-2020-13674 · published 2021-09-15T15:20:39Z · modified 2026-09-19T16:54:59Z · JSON