CVE-2020-13672: Cross-site Scripting (XSS) Vulnerability in Drupal
Summary
CVE-2020-13672: Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. Affects drupal across 4 version ranges.
< 7.80.0
>= 8.9.0, < 8.9.14
>= 9.0.0, < 9.0.12
>= 9.1.0, < 9.1.7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal/core · Packagist
- drupal/core · Packagist
The same CVE-2020-13672 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) that allows users to easily create and manage websites. It provides a flexible platform for building various types of websites, from personal blogs to large enterprise applications. Drupal is widely used and has a large community of developers and contributors. However, it is not immune to security vulnerabilities.
Vulnerability Detail
The vulnerability identified as CVE-2020-13672 is a Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API. This vulnerability occurs when the sanitization API fails to properly filter cross-site scripting under certain circumstances. An attacker can exploit this vulnerability to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized access, data theft, or other malicious activities. The vulnerability affects various versions of Drupal Core, including 9.1.x, 9.0.x, 8.9.x, and 7.x.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.80.07.80.0 -
>= 8.9.0, < 8.9.148.9.14 -
>= 9.0.0, < 9.0.129.0.12 -
>= 9.1.0, < 9.1.79.1.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround is to implement additional input validation and output encoding to prevent the execution of malicious scripts. This can be done by using security libraries or frameworks that provide built-in protection against XSS attacks. Here is an example of how to encode user input in PHP using the htmlspecialchars function:
$encodedInput = htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');
By encoding user input before displaying it on web pages, the risk of XSS attacks can be significantly reduced.
Conclusion
The Cross-site Scripting (XSS) vulnerability in Drupal Core's sanitization API poses a potential risk to websites built on Drupal. It is crucial to promptly update Drupal Core to the latest patched version to mitigate the vulnerability. Implementing additional input validation and output encoding can serve as a temporary workaround until the update is applied. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal →
FAQ
Drupal is an open-source content management system (CMS) that allows users to easily create and manage websites. It provides a flexible platform for building various types of websites, from personal blogs to large enterprise applications.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. This can lead to unauthorized access, data theft, or other malicious activities.
This vulnerability affects Drupal Core 9.1.x versions prior to 9.1.7, 9.0.x versions prior to 9.0.12, 8.9.x versions prior to 8.9.14, and 7.x versions prior to 7.80.
To fix this vulnerability, it is recommended to update Drupal Core to the latest patched version. For specific version updates, refer to the 'how_to_fix' section above.
If immediate updating is not possible, a temporary workaround is to implement additional input validation and output encoding to prevent the execution of malicious scripts. Refer to the 'workaround' section above for more details.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
