{"id":"CVE-2020-13672","aliases":["ALPINE-CVE-2020-13672","BIT-drupal-2020-13672","DEBIAN-CVE-2020-13672","DLA-2637-1","DRUPAL-CORE-2021-002","EUVD-2022-0793","GHSA-3m36-mjwj-352c","UBUNTU-CVE-2020-13672"],"status":"published","title":"Drupal core Cross-site Scripting (XSS) vulnerability","description":"Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00677,"percentile":0.52555,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2021-04-21T15:58:22Z","modified":"2026-11-03T06:32:23Z","fixes":[{"ecosystem":"Packagist","package":"drupal/core","fixed_in":["7.80","8.9.14","9.0.12","9.1.7"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"drupal/drupal","fixed_in":["7.80","8.9.14","9.0.12","9.1.7"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.13","package":"drupal7","fixed_in":["7.81-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"drupal7","fixed_in":["7.81-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"drupal7","fixed_in":["7.81-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"drupal7","fixed_in":["7.81-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"drupal7","fixed_in":["7.81-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"drupal7","fixed_in":["7.81-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"drupal7","fixed_in":["7.81-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"drupal7","fixed_in":["7.81-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"drupal","fixed_in":["7.80.0","8.9.14","9.0.12","9.1.7"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"drupal7","fixed_in":["7.52-2+deb9u15"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.80"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.9.14"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0"},{"fixed":"9.1.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.80"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.9.14"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0"},{"fixed":"9.1.7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"drupal","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.80.0"},{"introduced":"8.9.0"},{"fixed":"8.9.14"},{"introduced":"9.0.0"},{"fixed":"9.0.12"},{"introduced":"9.1.0"},{"fixed":"9.1.7"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52-2+deb9u15"}]}],"versions":["7.52-2","7.52-2+deb9u1","7.52-2+deb9u10","7.52-2+deb9u11","7.52-2+deb9u12","7.52-2+deb9u13","7.52-2+deb9u14","7.52-2+deb9u2","7.52-2+deb9u3","7.52-2+deb9u4","7.52-2+deb9u5","7.52-2+deb9u6","7.52-2+deb9u7","7.52-2+deb9u8","7.52-2+deb9u9"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.9.14"}]},{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.12"}]},{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0"},{"fixed":"9.1.7"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.1.0","8.1.0-beta1","8.1.0-beta2","8.1.0-rc1","8.1.1","8.1.10","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6","8.2.7","8.2.8","8.3.0","8.3.0-alpha1","8.3.0-beta1","8.3.0-rc1","8.3.0-rc2","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.3.6","8.3.7","8.3.8","8.3.9","8.4.0","8.4.0-alpha1","8.4.0-beta1","8.4.0-rc1","8.4.0-rc2","8.4.1","8.4.2","8.4.3","8.4.4","8.4.5","8.4.6","8.4.7","8.4.8","8.5.0","8.5.0-alpha1","8.5.0-beta1","8.5.0-rc1","8.5.1","8.5.10","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.7","8.5.8","8.5.9","8.6.0","8.6.0-alpha1","8.6.0-beta1","8.6.0-beta2","8.6.0-rc1","8.6.1","8.6.10","8.6.11","8.6.12","8.6.13","8.6.14","8.6.15","8.6.16","8.6.17","8.6.18","8.6.2","8.6.3","8.6.4","8.6.5","8.6.6","8.6.7","8.6.8","8.6.9","8.7.0","8.7.0-alpha1","8.7.0-alpha2","8.7.0-beta1","8.7.0-beta2","8.7.0-rc1","8.7.1","8.7.10","8.7.11","8.7.12","8.7.13","8.7.14","8.7.2","8.7.3","8.7.4","8.7.5","8.7.6","8.7.7","8.7.8","8.7.9","8.8.0","8.8.0-alpha1","8.8.0-beta1","8.8.0-rc1","8.8.1","8.8.10","8.8.11","8.8.12","8.8.2","8.8.3","8.8.4","8.8.5","8.8.6","8.8.7","8.8.8","8.8.9","8.9.0","8.9.0-beta1","8.9.0-beta2","8.9.0-beta3","8.9.0-rc1","8.9.1","8.9.10","8.9.11","8.9.12","8.9.13","8.9.2","8.9.3","8.9.4","8.9.5","8.9.6","8.9.7","8.9.8","8.9.9","9.0.0","9.0.1","9.0.10","9.0.11","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9","9.1.0","9.1.1","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.80"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.9.14"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.1.0","8.1.0-beta1","8.1.0-beta2","8.1.0-rc1","8.1.1","8.1.10","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6","8.2.7","8.2.8","8.3.0","8.3.0-alpha1","8.3.0-beta1","8.3.0-rc1","8.3.0-rc2","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.3.6","8.3.7","8.3.8","8.3.9","8.4.0","8.4.0-alpha1","8.4.0-beta1","8.4.0-rc1","8.4.0-rc2","8.4.1","8.4.2","8.4.3","8.4.4","8.4.5","8.4.6","8.4.7","8.4.8","8.5.0","8.5.0-alpha1","8.5.0-beta1","8.5.0-rc1","8.5.1","8.5.10","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.7","8.5.8","8.5.9","8.6.0","8.6.0-alpha1","8.6.0-beta1","8.6.0-beta2","8.6.0-rc1","8.6.1","8.6.10","8.6.11","8.6.12","8.6.13","8.6.14","8.6.15","8.6.16","8.6.17","8.6.18","8.6.2","8.6.3","8.6.4","8.6.5","8.6.6","8.6.7","8.6.8","8.6.9","8.7.0","8.7.0-alpha1","8.7.0-alpha2","8.7.0-beta1","8.7.0-beta2","8.7.0-rc1","8.7.1","8.7.10","8.7.11","8.7.12","8.7.13","8.7.14","8.7.2","8.7.3","8.7.4","8.7.5","8.7.6","8.7.7","8.7.8","8.7.9","8.8.0","8.8.0-alpha1","8.8.0-beta1","8.8.0-rc1","8.8.1","8.8.10","8.8.11","8.8.12","8.8.2","8.8.3","8.8.4","8.8.5","8.8.6","8.8.7","8.8.8","8.8.9","8.9.0","8.9.0-beta1","8.9.0-beta2","8.9.0-beta3","8.9.0-rc1","8.9.1","8.9.10","8.9.11","8.9.12","8.9.13","8.9.2","8.9.3","8.9.4","8.9.5","8.9.6","8.9.7","8.9.8","8.9.9"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.12"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0"},{"fixed":"9.1.7"}]}],"versions":["9.1.0","9.1.1","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.80"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.9.14"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.1.0","8.1.0-beta1","8.1.0-beta2","8.1.0-rc1","8.1.1","8.1.10","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6","8.2.7","8.2.8","8.3.0","8.3.0-alpha1","8.3.0-beta1","8.3.0-rc1","8.3.0-rc2","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.3.6","8.3.7","8.3.8","8.3.9","8.4.0","8.4.0-alpha1","8.4.0-beta1","8.4.0-rc1","8.4.0-rc2","8.4.1","8.4.2","8.4.3","8.4.4","8.4.5","8.4.6","8.4.7","8.4.8","8.5.0","8.5.0-alpha1","8.5.0-beta1","8.5.0-rc1","8.5.1","8.5.10","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.7","8.5.8","8.5.9","8.6.0","8.6.0-alpha1","8.6.0-beta1","8.6.0-beta2","8.6.0-rc1","8.6.1","8.6.10","8.6.11","8.6.12","8.6.13","8.6.14","8.6.15","8.6.16","8.6.17","8.6.18","8.6.2","8.6.3","8.6.4","8.6.5","8.6.6","8.6.7","8.6.8","8.6.9","8.7.0","8.7.0-alpha1","8.7.0-alpha2","8.7.0-beta1","8.7.0-beta2","8.7.0-rc1","8.7.1","8.7.10","8.7.11","8.7.12","8.7.13","8.7.14","8.7.2","8.7.3","8.7.4","8.7.5","8.7.6","8.7.7","8.7.8","8.7.9","8.8.0","8.8.0-alpha1","8.8.0-beta1","8.8.0-rc1","8.8.1","8.8.10","8.8.11","8.8.12","8.8.2","8.8.3","8.8.4","8.8.5","8.8.6","8.8.7","8.8.8","8.8.9","8.9.0","8.9.0-beta1","8.9.0-beta2","8.9.0-beta3","8.9.0-rc1","8.9.1","8.9.10","8.9.11","8.9.12","8.9.13","8.9.2","8.9.3","8.9.4","8.9.5","8.9.6","8.9.7","8.9.8","8.9.9"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.12"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0"},{"fixed":"9.1.7"}]}],"versions":["9.1.0","9.1.1","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.38-1","7.41-1","7.44-1ubuntu1~16.04.0","7.44-1ubuntu1~16.04.0+esm1","7.44-1ubuntu1~16.04.0+esm2","7.44-1ubuntu1~16.04.0+esm3"]}],"products":[{"vendor":"drupal","product":"core"},{"vendor":"drupal","product":"drupal"},{"vendor":"opnsense","product":"core"}],"references":[{"url":"https://www.drupal.org/sa-core-2021-002","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13672","tags":["web","advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13672.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13672.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3m36-mjwj-352c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-13672","tags":["advisory"]},{"url":"https://github.com/drupal/core","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-13672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13672","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-13672","description":"Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.","status":"published","published":"2022-02-11T15:30:12Z","modified":"2024-08-04T12:25:16.383Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:53.868619Z"}],"euvd":[{"id":"EUVD-2022-0793","description":"Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.","status":"published","published":"2022-02-11T15:30:12Z","modified":"2024-08-04T12:25:16Z","updated_at":"2026-11-03T03:07:36.182524Z"}],"ghsa":[{"id":"GHSA-3m36-mjwj-352c","title":"Drupal core Cross-site Scripting (XSS) vulnerability","description":"Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.","status":"published","published":"2022-02-12T00:00:47Z","modified":"2024-05-24T19:21:23Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:51.549437Z"}],"nvd":[{"id":"CVE-2020-13672","description":"Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.","status":"published","published":"2022-02-11T16:15:08.19Z","modified":"2026-06-17T02:53:33.04Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:46.951463Z"}],"osv":[{"id":"ALPINE-CVE-2020-13672","description":"Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.","status":"published","published":"2022-02-11T16:15:08.19Z","modified":"2026-11-03T06:32:23.725716928Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-13672","description":"Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.","status":"published","published":"2022-02-11T16:15:08.19Z","modified":"2026-10-24T10:30:51.898545887Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"GHSA-3m36-mjwj-352c","title":"Drupal core Cross-site Scripting (XSS) vulnerability","description":"Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.","status":"published","published":"2022-02-12T00:00:47Z","modified":"2025-12-10T23:41:01.582577Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"UBUNTU-CVE-2020-13672","description":"Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.","status":"published","published":"2022-02-11T16:15:00Z","modified":"2025-09-08T16:46:09Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"BIT-drupal-2020-13672","description":"Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.","status":"published","published":"2024-03-06T10:57:10.585Z","modified":"2026-09-08T08:47:01.493156726Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"DLA-2637-1","title":"drupal7 - security update","status":"published","published":"2021-04-23T00:00:00Z","modified":"2026-03-09T01:19:03.552876Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DRUPAL-CORE-2021-002","description":"Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances.\n\nNot all sites and users are affected, but configuration changes to prevent the exploit might be impractical and will vary between sites. Therefore, we recommend all sites update to this release as soon as possible.","status":"published","published":"2021-04-21T15:58:22Z","modified":"2026-09-19T17:43:24Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}