Vulnerability advisory

GHSA-8jj2-x2gc-ggm7

Drupal Core Cross-site scripting vulnerability

Published May 24, 2022Updated Dec 10, 2025OSV record ↗

Also known as BIT-drupal-2020-13666CVE-2020-13666DRUPAL-CORE-2020-007

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`8.8.0` to before 8.8.10	`8.8.10`Advisories →
Also listed as affected (10) `8.8.0` `8.8.1` `8.8.2` `8.8.3` `8.8.4` `8.8.5` `8.8.6` `8.8.7` `8.8.8` `8.8.9`
`8.9.0` to before 8.9.6	`8.9.6`Advisories →
Also listed as affected (6) `8.9.0` `8.9.1` `8.9.2` `8.9.3` `8.9.4` `8.9.5`
`9.0.0` to before 9.0.6	`9.0.6`Advisories →
Also listed as affected (6) `9.0.0` `9.0.1` `9.0.2` `9.0.3` `9.0.4` `9.0.5`
`7.0.0` to before 7.73	`7.73`Advisories →

drupal/drupal Packagist

All drupal/drupal advisories →

Affected	Fixed in
`7.0.0` to before 7.73	`7.73`Advisories →
`8.8.0` to before 8.8.10	`8.8.10`Advisories →
Also listed as affected (10) `8.8.0` `8.8.1` `8.8.2` `8.8.3` `8.8.4` `8.8.5` `8.8.6` `8.8.7` `8.8.8` `8.8.9`
`8.9.0` to before 8.9.6	`8.9.6`Advisories →
Also listed as affected (6) `8.9.0` `8.9.1` `8.9.2` `8.9.3` `8.9.4` `8.9.5`
`9.0.0` to before 9.0.6	`9.0.6`Advisories →
Also listed as affected (6) `9.0.0` `9.0.1` `9.0.2` `9.0.3` `9.0.4` `9.0.5`

Description

Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

GHSA-8jj2-x2gc-ggm7

Affected versions

drupal/core Packagist

drupal/drupal Packagist

Description

References