GitHub Advisoryadvisory · Packagist

GHSA-m648-hpf8-qcjw Drupal Core Cross-Site Request Forgery (CSRF) vulnerability

HIGH Published 2022-05-24 Modified 2024-02-06 Official page ↗
Aliases
CVE-2020-13663
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2023-12-20

Affected packages

• Packagist drupal/core: >= 8.9.0, < 8.9.1 → fixed in 8.9.1 • Packagist drupal/core: >= 9.0.0, < 9.0.1 → fixed in 9.0.1 • Packagist drupal/core: >= 7.0.0, < 7.72 → fixed in 7.72 • Packagist drupal/core: >= 8.0.0, < 8.8.8 → fixed in 8.8.8 • Packagist drupal/drupal: >= 7.0.0, < 7.72 → fixed in 7.72 • Packagist drupal/drupal: >= 8.0.0, < 8.8.8 → fixed in 8.8.8 • Packagist drupal/drupal: >= 8.9.0, < 8.9.1 → fixed in 8.9.1 • Packagist drupal/drupal: >= 9.0.0, < 9.0.1 → fixed in 9.0.1

Description

Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.

Related

Alias · CVE (1)

  • CVE-2020-13663 Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests,… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References