CVE-2020-13672

State: Published
Severity: Not scored
Published: Feb 11, 2022
Updated: Aug 4, 2024
Reserved: May 28, 2020

Description

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Scores

The record has no CVSS score.

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
CoreDrupal	9.1.x to before 9.1.7Affected 9.0.x to before 9.0.12Affected 8.9.x to before 8.9.14Affected 7.x to before 7.80Affected

References

https://www.drupal.org/sa-core-2021-002

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.