CVE-2020-13666: Drupal Core Cross-site scripting vulnerability
Summary
CVE-2020-13666: Drupal Core Cross-site scripting vulnerability. Affects drupal/core across 4 version ranges.
>= 7.0.0, < 7.73
>= 8.8.0, < 8.8.10
>= 8.9.0, < 8.9.6
>= 9.0.0, < 9.0.6
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2020-13666 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal Core is an open-source content management system (CMS) used for building websites and applications. It provides a flexible framework for creating and managing digital content. The vulnerability identified as CVE-2020-13666 affects Drupal Core versions 7.x prior to 7.73, 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6, and 9.0.x prior to 9.0.6. This vulnerability exposes the system to cross-site scripting (XSS) attacks through the Drupal AJAX API, which does not disable JSONP by default.
Vulnerability Detail
The cross-site scripting vulnerability in Drupal Core allows an attacker to inject malicious scripts into web pages viewed by users. By exploiting this vulnerability, an attacker can execute arbitrary code in the context of the affected user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. The vulnerability arises from the failure to disable JSONP in the Drupal AJAX API, which enables an attacker to bypass security measures and inject malicious scripts.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.737.73composer require drupal/core:7.73 -
>= 8.8.0, < 8.8.108.8.10composer require drupal/core:8.8.10 -
>= 8.9.0, < 8.9.68.9.6composer require drupal/core:8.9.6 -
>= 9.0.0, < 9.0.69.0.6composer require drupal/core:9.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually disable JSONP in the Drupal AJAX API by modifying the relevant configuration files. This can be done by setting the 'jsonp' option to 'false' in the AJAX API configuration. However, it is strongly recommended to apply the official fix by updating to the latest Drupal Core version.
Conclusion
The Drupal Core Cross-site scripting vulnerability (CVE-2020-13666) exposes websites and applications to the risk of cross-site scripting attacks. To mitigate this vulnerability, it is crucial to update Drupal Core to the fixed versions and review any custom code or modules that may be affected. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal Core is an open-source content management system (CMS) used for building websites and applications. It provides a flexible framework for creating and managing digital content.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. This can lead to unauthorized access, data theft, or other malicious activities.
The Drupal Core XSS vulnerability arises from the failure to disable JSONP in the Drupal AJAX API. This allows an attacker to bypass security measures and inject malicious scripts into web pages viewed by users.
By exploiting this vulnerability, an attacker can execute arbitrary code in the context of the affected user's browser. This can lead to unauthorized access, data theft, or other malicious activities.
To fix this vulnerability, it is recommended to update Drupal Core to the fixed versions: 7.73, 8.8.10, 8.9.6, or 9.0.6, depending on the version being used. Users should also review and update any custom code or modules that may be affected.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
