Drupal Core Cross-site Scripting (XSS) Vulnerability
Summary
CVE-2020-13672: Drupal core Cross-site Scripting (XSS) vulnerability. Affects drupal/core across 4 version ranges.
>= 7.0.0, < 7.80
>= 8.0.0, < 8.9.14
>= 9.0.0, < 9.0.12
>= 9.1.0, < 9.1.7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2020-13672 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Core is a content management system (CMS) that allows users to create and manage websites. It provides a wide range of features and functionality, making it a popular choice for building websites of all sizes. However, Drupal Core is vulnerable to a Cross-site Scripting (XSS) vulnerability, which can allow attackers to inject malicious scripts into web pages viewed by users. This vulnerability affects Drupal Core versions 7.x, 8.x, and 9.x.
Vulnerability Detail
The Cross-site Scripting (XSS) vulnerability in Drupal Core's sanitization API allows attackers to bypass the filtering mechanism and inject malicious scripts into web pages. This can lead to various security risks, including unauthorized access to sensitive information, session hijacking, and the execution of arbitrary code. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.807.80composer require drupal/core:7.80 -
>= 8.0.0, < 8.9.148.9.14composer require drupal/core:8.9.14 -
>= 9.0.0, < 9.0.129.0.12composer require drupal/core:9.0.12 -
>= 9.1.0, < 9.1.79.1.7composer require drupal/core:9.1.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround is to implement additional input validation and output encoding measures in custom code and templates. This can help mitigate the risk of XSS attacks. Here is an example of how to sanitize user input in PHP:
$input = $_POST['input'];
$sanitizedInput = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
Conclusion
The Drupal Core Cross-site Scripting (XSS) vulnerability poses a moderate security risk to websites built on Drupal Core. It is crucial to update to the latest version of Drupal Core (7.80, 8.9.14, or 9.1.7) to patch the vulnerability and enhance the sanitization API's filtering mechanism. Implementing additional input validation and output encoding measures can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. These scripts can be used to steal sensitive information, manipulate website content, or perform other malicious actions.
The Drupal Core XSS vulnerability allows attackers to inject malicious scripts into web pages, potentially compromising the security and integrity of websites. This can lead to unauthorized access to sensitive information, session hijacking, and the execution of arbitrary code.
Yes, the vulnerability affects Drupal Core versions 7.x, 8.x, and 9.x. It is recommended to update to the latest version of each major release to ensure the vulnerability is patched.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level. It is important to address this vulnerability promptly to mitigate the associated risks.
Yes, you can use Vulert's playground at Vulert Scanner to check if your Drupal Core installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
