CVE-2020-13672 — Cross-site Scripting in Drupal Core

CWE-79 — Cross-site Scripting7 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.6%
top 31.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Drupal CoreDrupal
Timeline
PublishedFeb 11
Latest updateFeb 12

Description

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶CVEListV5drupal/core9.1.x — 9.1.7+3
▶Packagistdrupal/core7.0.0 — 7.80+3
▶NVDdrupal/drupal8.9.0 — 8.9.14+3
▶Packagistdrupal/drupal7.0.0 — 7.80+3

Patches

Patch: www.drupal.org ↗Patch: www.drupal.org ↗

🔴Vulnerability Details

5
OSV
Drupal core Cross-site Scripting (XSS) vulnerability↗2022-02-12
▶
GHSA
Drupal core Cross-site Scripting (XSS) vulnerability↗2022-02-12
▶
CVEList
CVE-2020-13672: Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances↗2022-02-11
▶
OSV
CVE-2020-13672: Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances↗2022-02-11
▶
OSV
CVE-2020-13672: Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances↗2021-04-21
▶

📋Vendor Advisories

1
Drupal
Drupal core - Critical - Cross-site scripting - SA-CORE-2021-002↗2021-04-21
▶
CVE-2020-13672 — Cross-site Scripting in Drupal Core | cvebase