Every CVE Search/ Get API key

CVE-2020-13672

Drupal core Cross-site Scripting (XSS) vulnerability

6.1 MediumFix available

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.68%Down 0.2 points since Feb 12, 2022
90%50%10%1%

What each source reports

NVD Score used 6.1

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Record
CVE-2020-13672
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
2.6 LowAV:N/AC:H/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Record
CVE-2020-13672
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2022-0793 No score

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Record
EUVD-2022-0793
Updated
2026-11-03
GitHub AdvisoriesGHSA-3m36-mjwj-352c 6.1

Drupal core Cross-site Scripting (XSS) vulnerability

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Record
GHSA-3m36-mjwj-352c
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVALPINE-CVE-2020-13672 6.1

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Record
ALPINE-CVE-2020-13672
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
OSV 6.1

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Record
CVE-2020-13672
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-3m36-mjwj-352c 6.1

Drupal core Cross-site Scripting (XSS) vulnerability

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Record
GHSA-3m36-mjwj-352c
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2020-13672 6.1

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Record
UBUNTU-CVE-2020-13672
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVBIT-drupal-2020-13672 No score

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Record
BIT-drupal-2020-13672
Updated
2026-11-02
OSVDRUPAL-CORE-2021-002 No score

Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances.

Not all sites and users are affected, but configuration changes to prevent the exploit might be impractical and will vary between sites. Therefore, we recommend all sites update to this release as soon as possible.

Record
DRUPAL-CORE-2021-002
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
drupal/core
Packagist
 7.0.0 up to 7.80
7.80
drupal/core
Packagist
 8.0.0 up to 8.9.14
8.9.14
drupal/core
Packagist
 9.0.0 up to 9.0.12
9.0.12
drupal/core
Packagist
 9.1.0 up to 9.1.7
9.1.7
drupal/drupal
Packagist
 7.0.0 up to 7.80
7.80
drupal/drupal
Packagist
 8.0.0 up to 8.9.14
8.9.14
drupal/drupal
Packagist
 9.0.0 up to 9.0.12
9.0.12
drupal/drupal
Packagist
 9.1.0 up to 9.1.7
9.1.7
drupal7
Alpine:v3.13
 before 7.81-r0
7.81-r0
drupal7
Alpine:v3.14
 before 7.81-r0
7.81-r0
Show 17 moreShow less
Affected packages
PackageAffectedFixed
drupal7
Alpine:v3.15
 before 7.81-r0
7.81-r0
drupal7
Alpine:v3.16
 before 7.81-r0
7.81-r0
drupal7
Alpine:v3.17
 before 7.81-r0
7.81-r0
drupal7
Alpine:v3.18
 before 7.81-r0
7.81-r0
drupal7
Alpine:v3.19
 before 7.81-r0
7.81-r0
drupal7
Alpine:v3.20
 before 7.81-r0
7.81-r0
drupal
Bitnami
 before 7.80.0, 8.9.0 up to 8.9.14, 9.0.0 up to 9.0.12, 9.1.0 up to 9.1.7
7.80.08.9.149.0.129.1.7
drupal7
Debian:9
 before 7.52-2+deb9u15, plus listed versions
7.52-27.52-2+deb9u17.52-2+deb9u107.52-2+deb9u117.52-2+deb9u12
Show 10 moreShow less
7.52-2+deb9u137.52-2+deb9u147.52-2+deb9u27.52-2+deb9u37.52-2+deb9u47.52-2+deb9u57.52-2+deb9u67.52-2+deb9u77.52-2+deb9u87.52-2+deb9u9
7.52-2+deb9u15
drupal/core
Packagist
 8.0.0 up to 8.9.14, 9.0.0 up to 9.0.12, 9.1.0 up to 9.1.7, plus listed versions
8.0.18.0.28.0.38.0.48.0.5
Show 45 moreShow less
8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1
8.9.149.0.129.1.7
drupal/core
Packagist
 8.0.0 up to 8.9.14, plus listed versions
8.0.18.0.28.0.38.0.48.0.5
Show 45 moreShow less
8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1
8.9.14
drupal/core
Packagist
 9.0.0 up to 9.0.12, plus listed versions
9.0.19.0.109.0.119.0.29.0.3
Show 6 moreShow less
9.0.49.0.59.0.69.0.79.0.89.0.9
9.0.12
drupal/core
Packagist
 9.1.0 up to 9.1.7, plus listed versions
9.1.19.1.29.1.39.1.49.1.59.1.6
9.1.7
drupal/drupal
Packagist
 8.0.0 up to 8.9.14, plus listed versions
8.0.18.0.28.0.38.0.48.0.5
Show 45 moreShow less
8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1
8.9.14
drupal/drupal
Packagist
 9.0.0 up to 9.0.12, plus listed versions
9.0.19.0.109.0.119.0.29.0.3
Show 6 moreShow less
9.0.49.0.59.0.69.0.79.0.89.0.9
9.0.12
drupal/drupal
Packagist
 9.1.0 up to 9.1.7, plus listed versions
9.1.19.1.29.1.39.1.49.1.59.1.6
9.1.7
drupal7
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3
 None known
drupal7
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
7.38-17.41-17.44-1ubuntu1~16.04.07.44-1ubuntu1~16.04.0+esm17.44-1ubuntu1~16.04.0+esm27.44-1ubuntu1~16.04.0+esm3
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-13672 is a medium vulnerability (CVSS 6.1) in Drupal Core, published April 21, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in drupal/core 7.80.

References

This page doesn't list everything

Left out here: 338 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open