Vulnerability advisory

CVE-2020-13672

Published Feb 11, 2022Updated Oct 24, 2026OSV record ↗

Also known as BIT-drupal-2020-13672DRUPAL-CORE-2021-002GHSA-3m36-mjwj-352c

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
All commits before 069f956d68b4dbee470224b21e2c2cab38954725	`069f956d68b4dbee470224b21e2c2cab38954725`
a412ca41cfc0d954fe3cb2dd982dc6ca049b1c70 to before f3512fc3fb6fe1788cfb5a4b169657d46ffdba80	`f3512fc3fb6fe1788cfb5a4b169657d46ffdba80`
d62812dc17ce593beb2ccd4cdbee1a76c95e3fd7 to before d40dbd050e2ef07b9737e5919de11c3ff8d660a6	`d40dbd050e2ef07b9737e5919de11c3ff8d660a6`
5c6f14f762c9aef87cd2731818386f202ee8463c to before 8a04fee4a8ef8e40cc4507a59031ed336d6eae2e	`8a04fee4a8ef8e40cc4507a59031ed336d6eae2e`
Also listed as affected (92) `7.79` `8.9.13` `9.0.11` `9.1.6` `9.1.5` `9.1.4` `7.77` `8.9.12` `9.0.10` `9.1.2` `9.1.1` `8.9.11` `9.1.0` `7.76` `8.9.8` `8.9.5` `9.0.5` `8.9.4` `8.9.3` `9.0.3` `8.9.2` `9.0.2` `7.71` `8.9.0` `9.0.0` `7.68` `7.64` `7.61` `7.56` `7.55` `7.54` `7.51` `7.50` `7.43` `7.42` `7.40` `7.37` `7.36` `7.33` `7.30` `7.28` `7.25` `7.23` `7.22` `7.17` `7.15` `7.14` `7.12` `7.10` `7.9` `7.8` `7.7` `7.6` `7.4` `7.0` `7.0-rc-4` `7.0-rc-3` `7.0-rc-2` `7.0-rc-1` `7.0-beta3` `7.0-beta2` `7.0-beta1` `7.0-alpha7` `7.0-alpha6` `7.0-alpha5` `7.0-alpha4` `7.0-alpha3` `7.0-alpha2` `7.0-alpha1` `7.0-unstable-10` `7.0-unstable-7` `7.0-unstable-6` `7.0-unstable-5` `7.0-unstable-4` `7.0-unstable-3` `7.0-unstable-2` `7.0-unstable-1` `6.0-rc-3` `6.0-rc-2` `6.0-rc-1` `6.0-beta-4` `6.0-beta-3` `6.0-beta-2` `6.0-beta-1` `5.0-rc-2` `5.0-rc-1` `5.0-beta-2` `5.0-beta-1` `3.0.1` `2.0` `1.0` `start`

Description

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

References

Fixwww.drupal.org/sa-core-2021-002 ↗