CVE-2020-13688

🗓️ 11 Jun 2021 15:08:56Reported by drupalType

Cross-site scripting vulnerability in Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6

Reporter	Title	Published	Views	Family All 16
CNNVD	Drupal Core 跨站脚本漏洞	11 Jun 202100:00	–	cnnvd
CNVD	Drupal Core Cross-Site Scripting Vulnerability (CNVD-2021-43374)	17 Jun 202100:00	–	cnvd
Cvelist	CVE-2020-13688	11 Jun 202115:08	–	cvelist
Debian CVE	CVE-2020-13688	11 Jun 202115:08	–	debiancve
Drupal	Drupal core - Critical - Cross-site scripting - SA-CORE-2020-009	16 Sep 202000:00	–	drupal
EUVD	EUVD-2022-4953	3 Oct 202520:07	–	euvd
Github Security Blog	Drupal Core Cross-site scripting vulnerability	24 May 202219:05	–	github
NVD	CVE-2020-13688	11 Jun 202115:15	–	nvd
OpenVAS	Drupal 8.x, 9.x Multiple Vulnerabilities (SA-CORE-2020-008, SA-CORE-2020-009, SA-CORE-2020-010, SA-CORE-2020-011) - Linux	17 Sep 202000:00	–	openvas
OpenVAS	Drupal 8.x, 9.x Multiple Vulnerabilities (SA-CORE-2020-008, SA-CORE-2020-009, SA-CORE-2020-010, SA-CORE-2020-011) - Windows	17 Sep 202000:00	–	openvas

NVD

Node

drupal drupalRange8.8.0–8.8.10

drupal drupalRange8.9.0–8.9.6

drupal drupalRange9.0.0–9.0.6

[
  {
    "product": "Drupal Core",
    "vendor": "Drupal",
    "versions": [
      {
        "lessThan": "8.8.10",
        "status": "affected",
        "version": "8.8.X",
        "versionType": "custom"
      },
      {
        "lessThan": "8.9.6",
        "status": "affected",
        "version": "8.9.X",
        "versionType": "custom"
      },
      {
        "lessThan": "9.0.6",
        "status": "affected",
        "version": "9.0.X",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
drupal	www.drupal.org/sa-core-2020-009

21 Nov 2024 05:01Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.0034

CWE-79