https://www.drupal.org/sa-core-2020-005

NIST AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NIST (AV:N/AC:M/Au:N/C:C/I:C/A:C)

NIST CWE-77

OR
     *cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.8.0 up to (excluding) 8.8.8
     *cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.9.0 up to (excluding) 8.9.1
     *cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 9.0.0 up to (excluding) 9.0.1

https://www.drupal.org/sa-core-2020-005 No Types Assigned

https://www.drupal.org/sa-core-2020-005 Vendor Advisory

Victim must voluntarily interact with attack mechanism

Arbitrary PHP code execution vulnerability in  Drupal Core  under certain circumstances.

An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability.

Windows servers are most likely to be affected.

This issue affects:
Drupal Drupal Core
8.8.x versions prior to 8.8.8;
8.9.x versions prior to 8.9.1;

Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.