CVE-2020-13672
- Source
- https://cve.org/CVERecord?id=CVE-2020-13672
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13672.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-13672
- Aliases
- Downstream
- Published
- 2022-02-11T16:15:08.190Z
- Modified
- 2026-04-10T04:18:43.030230Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.
- References
Affected packages
Git / github.com/drupal/drupal
Affected ranges
- Type
- GIT
- Repo
- https://github.com/drupal/drupal
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
{ "versions": [ { "introduced": "0" }, { "fixed": "7.80" }, { "introduced": "8.9.0" }, { "fixed": "8.9.14" }, { "introduced": "9.0.0" }, { "fixed": "9.0.12" }, { "introduced": "9.1.0" }, { "fixed": "9.1.7" } ] }
Affected versions
1.*
1.0
2.*
2.0
3.*
3.0.1
5.*
5.0-beta-1
5.0-beta-2
5.0-rc-1
5.0-rc-2
6.*
6.0-beta-1
6.0-beta-2
6.0-beta-3
6.0-beta-4
6.0-rc-1
6.0-rc-2
6.0-rc-3
7.*
7.0
7.0-alpha1
7.0-alpha2
7.0-alpha3
7.0-alpha4
7.0-alpha5
7.0-alpha6
7.0-alpha7
7.0-beta1
7.0-beta2
7.0-beta3
7.0-rc-1
7.0-rc-2
7.0-rc-3
7.0-rc-4
7.0-unstable-1
7.0-unstable-10
7.0-unstable-2
7.0-unstable-3
7.0-unstable-4
7.0-unstable-5
7.0-unstable-6
7.0-unstable-7
7.10
7.12
7.14
7.15
7.17
7.22
7.23
7.25
7.28
7.30
7.33
7.36
7.37
7.4
7.40
7.42
7.43
7.50
7.51
7.54
7.55
7.56
7.6
7.61
7.64
7.68
7.7
7.71
7.76
7.77
7.79
7.8
7.9
8.*
8.9.0
8.9.11
8.9.12
8.9.13
8.9.2
8.9.3
8.9.4
8.9.5
8.9.8
9.*
9.0.0
9.0.10
9.0.11
9.0.2
9.0.3
9.0.5
9.1.0
9.1.1
9.1.2
9.1.4
9.1.5
9.1.6
Other
start