CVE-2020-13666: Cross-site scripting vulnerability in Drupal Core
Summary
CVE-2020-13666: Cross-site scripting vulnerability in Drupal Core. Affects drupal across 4 version ranges.
>= 7.0.0, < 7.73.0
>= 8.8.0, < 8.8.10
>= 8.9.0, < 8.9.6
>= 9.0.0, < 9.0.6
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal/core · Packagist
The same CVE-2020-13666 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible framework for building websites and applications. The Drupal Core package is the foundation of the Drupal CMS, providing essential functionality and features. However, versions prior to 7.73, 8.8.10, 8.9.6, and 9.0.6 are vulnerable to a cross-site scripting (XSS) attack through the Drupal AJAX API.
Vulnerability Detail
The Drupal AJAX API does not disable JSONP by default, which allows an attacker to exploit the system through a cross-site scripting (XSS) attack. By injecting malicious code into JSONP responses, an attacker can execute arbitrary JavaScript code in the victim's browser. This can lead to various consequences, such as stealing sensitive information, session hijacking, or defacement of the affected Drupal website.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.73.07.73.0 -
>= 8.8.0, < 8.8.108.8.10 -
>= 8.9.0, < 8.9.68.9.6 -
>= 9.0.0, < 9.0.69.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround is to manually disable JSONP in the Drupal AJAX API. This can be achieved by modifying the Drupal configuration or implementing custom code to disable JSONP functionality. However, this workaround should only be considered as a temporary solution, and updating to the latest secure version is strongly recommended.
Conclusion
The cross-site scripting vulnerability in Drupal Core can have severe consequences, including unauthorized access, data theft, and website defacement. It is crucial for website administrators to promptly update their Drupal installations to the secure versions mentioned above. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal →
FAQ
Drupal Core is the foundational package of the Drupal CMS, providing essential functionality and features for building websites and applications.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various consequences, such as stealing sensitive information or executing arbitrary code.
By exploiting the Drupal AJAX API's lack of JSONP disabling, an attacker can inject malicious code into JSONP responses, which will be executed by the victim's browser. This can lead to unauthorized access, data theft, or website defacement.
The vulnerability affects Drupal Core versions prior to 7.73, 8.8.10, 8.9.6, and 9.0.6.
To protect your Drupal installation, it is crucial to update the Drupal Core package to version 7.73, 8.8.10, 8.9.6, or 9.0.6. Additionally, following secure coding practices and regularly monitoring for security updates is recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
