Project:
Date:
2020-September-16
Vulnerability:
Cross-site scripting
CVE IDs:
CVE-2020-13668
Description:
Drupal 8 and 9 have a reflected cross-site scripting (XSS) vulnerability under certain circumstances.
An attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability.
Solution:
Install the latest version:
- If you are using Drupal 8.8.x, upgrade to Drupal 8.8.10.
- If you are using Drupal 8.9.x, upgrade to Drupal 8.9.6.
- If you are using Drupal 9.0.x, upgrade to Drupal 9.0.6.
Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.10.
In addition to updating Drupal core, sites that override \Drupal\Core\Form\FormBuilder's renderPlaceholderFormAction() and/or buildFormAction() methods in contrib and/or custom code should ensure that appropriate sanitization is applied for URLs.
Reported By:
- Nuno Ramos
- markwittens
- Nathan Dentzau
- Marc Addeo
- Alejandro Garza
- Drew Webber of the Drupal Security Team
Fixed By:
- Lee Rowlands of the Drupal Security Team
- David Rothstein of the Drupal Security Team
- Wim Leers
- Vijay Mani, provisional member of the Drupal Security Team
- Drew Webber of the Drupal Security Team
- Nathan Dentzau
- Heine of the Drupal Security Team
- Joseph Zhao, provisional member of the Drupal Security Team
- Jess of the Drupal Security Team
- Tim Plunkett