CVE-2020-13668

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in packagist/drupal/drupal

Identifiers

GHSA-m6q5-wv4x-fv6h, CVE-2020-13668

Package Slug

packagist/drupal/drupal

Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Description

Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

Affected Versions

All versions starting from 8.0.0 before 8.8.10, all versions starting from 8.9.0 before 8.9.6, all versions starting from 9.0.0 before 9.0.6

Solution

Upgrade to versions 8.8.10, 8.9.6, 9.0.6 or above.

Last Modified

2024-02-06

source