Bug 1971043 (CVE-2020-13688) - CVE-2020-13688 drupal: an attacker could leverage the way that HTML is rendered for affected forms
Summary: CVE-2020-13688 drupal: an attacker could leverage the way that HTML is render...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-13688
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-06-11 17:57 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-09-10 13:22 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2021-09-10 13:22:56 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2021-06-11 17:57:37 UTC 
Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability.
This issue affects:
Drupal Core
8.8.X versions prior to 8.8.10;
8.9.X versions prior to 8.9.6;
9.0.X versions prior to 9.0.6.

Reference:
https://www.drupal.org/sa-core-2020-009
Comment 1 Shawn Iwinski 2021-09-10 04:23:20 UTC 
> 8.9.X versions prior to 8.9.6

Version 8.9.11 releases:
- f32: https://bodhi.fedoraproject.org/updates/FEDORA-2020-d50d74d6f2
- f33: https://bodhi.fedoraproject.org/updates/FEDORA-2020-6f1079934c
- f34+: https://bodhi.fedoraproject.org/updates/FEDORA-2020-03e30ffa1c


Please close this bug
Note You need to log in before you can comment on or make changes to this bug.