Cross-Site Scripting Vulnerability in Drupal Core by Drupal
CVE-2020-13672
6.1MEDIUM
What is CVE-2020-13672?
This vulnerability arises from a failure in Drupal core's sanitization API to adequately filter Cross-Site Scripting attacks under specific circumstances. As a result, attackers may exploit this flaw to execute arbitrary scripts in the user's browser, potentially leading to unauthorized access to sensitive information or user sessions when interacting with affected versions of Drupal. It's crucial for users to ensure their installations are updated to the latest versions to mitigate any risks associated with this vulnerability.
Affected Version(s)
Core 9.1.x < 9.1.7
Core 9.0.x < 9.0.12
Core 8.9.x < 8.9.14