DRUPAL-CORE-2020-009

En bref

Publiée: 2020-09-16 16:11 UTC
Mise à jour: 2026-09-19 17:34 UTC
CVE: CVE-2020-13688
Alias: BIT-drupal-2020-13688, GHSA-qf2g-mrrx-rr5p

Description

Drupal 8 and 9 have a reflected cross-site scripting (XSS) vulnerability under certain circumstances. An attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability.

Paquets affectés

Paquet	Versions
Packagist · drupal/core	introduced 8.0.0, fixed 8.8.10 ; introduced 8.9.0, fixed 8.9.6 ; introduced 9.0.0, fixed 9.0.6

Références

https://www.drupal.org/sa-core-2020-009 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence