CVE-2020-13672: Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This…

PriorityP425medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.66%

47.0th percentile

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
drupal	core	>= 7.0.0 < 7.80	7.80
drupal	core	>= 7.x < 7.80	7.80
drupal	core	>= 8.0.0 < 8.9.14	8.9.14
drupal	core	>= 8.9.x < 8.9.14	8.9.14
drupal	core	>= 9.0.0 < 9.0.12	9.0.12
drupal	core	>= 9.0.x < 9.0.12	9.0.12
drupal	core	>= 9.1.0 < 9.1.7	9.1.7
drupal	core	>= 9.1.x < 9.1.7	9.1.7
drupal	drupal	< 7.80	7.80
drupal	drupal	>= 7.0.0 < 7.80	7.80
drupal	drupal	>= 8.0.0 < 8.9.14	8.9.14
drupal	drupal	>= 8.9.0 < 8.9.14	8.9.14
drupal	drupal	>= 9.0.0 < 9.0.12	9.0.12
drupal	drupal	>= 9.0.0 < 9.0.12	9.0.12
drupal	drupal	>= 9.1.0 < 9.1.7	9.1.7
drupal	drupal	>= 9.1.0 < 9.1.7	9.1.7
drupal	drupal_core	—	—

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:P/A:N

osv6.1MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.