GitHub Advisoryadvisory · Packagist

GHSA-m6q5-wv4x-fv6h Cross-site Scripting in Drupal Core

MEDIUM Published 2022-02-12 Modified 2022-02-25 Official page ↗
Aliases
CVE-2020-13668
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-02-25

Affected packages

• Packagist drupal/core: >= 8.0.0, < 8.8.10 → fixed in 8.8.10 • Packagist drupal/core: >= 8.9.0, < 8.9.6 → fixed in 8.9.6 • Packagist drupal/core: >= 9.0.0, < 9.0.6 → fixed in 9.0.6 • Packagist drupal/drupal: >= 8.0.0, < 8.8.10 → fixed in 8.8.10 • Packagist drupal/drupal: >= 8.9.0, < 8.9.6 → fixed in 8.9.6 • Packagist drupal/drupal: >= 9.0.0, < 9.0.6 → fixed in 9.0.6

Description

Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

Related

Alias · CVE (1)

  • CVE-2020-13668 Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References