Bug 1971043 (CVE-2020-13688)

Summary: CVE-2020-13688 drupal: an attacker could leverage the way that HTML is rendered for affected forms
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: jsmith.fedora, peter.borsa, shawn, stickster
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-09-10 13:22:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Guilherme de Almeida Suckevicz 2021-06-11 17:57:37 UTC 
Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability.
This issue affects:
Drupal Core
8.8.X versions prior to 8.8.10;
8.9.X versions prior to 8.9.6;
9.0.X versions prior to 9.0.6.

Reference:
https://www.drupal.org/sa-core-2020-009
Comment 1 Shawn Iwinski 2021-09-10 04:23:20 UTC 
> 8.9.X versions prior to 8.9.6

Version 8.9.11 releases:
- f32: https://bodhi.fedoraproject.org/updates/FEDORA-2020-d50d74d6f2
- f33: https://bodhi.fedoraproject.org/updates/FEDORA-2020-6f1079934c
- f34+: https://bodhi.fedoraproject.org/updates/FEDORA-2020-03e30ffa1c


Please close this bug