Drupal Core Cross-site scripting vulnerability

MOYENNE 6.1CVE-2020-13688 · BIT-drupal-2020-13688 · DRUPAL-CORE-2020-009 · Published 11/06/2021 · updated 17/06/2026

En bref

CVE-2020-13688 est une vulnérabilité MOYENNE (CVSS 6.1) touchant drupal/core, drupal (drupal).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.66%, plus élevée que 51.6% des vulnérabilités.
Correctif : mettre à jour vers 8.8.10, 8.9.6, 9.0.6 ou plus récent.

Package	Affected versions	Patched versions
drupal/core Packagist	`≥ 8.0.0, < 8.8.10≥ 8.8.0, < 8.8.10≥ 8.9.0, < 8.9.6≥ 9.0.0, < 9.0.6`	`8.8.108.9.69.0.6`
drupal drupal	`≥ 8.8.0, < 8.8.10≥ 8.9.0, < 8.9.6≥ 9.0.0, < 9.0.6`	`8.8.108.9.69.0.6`

Description

Cross-site scripting vulnerability in Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.

NVD description

Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.