Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.Project:
Date:
2020-September-16
Vulnerability:
Cross-site scripting
Affected versions:
>= 8.0.0 <8.8.10 || >= 8.9.0 <8.9.6 || >=9.0.0 <9.0.6
CVE IDs:
CVE-2020-13688
Description:
Drupal 8 and 9 have a reflected cross-site scripting (XSS) vulnerability under certain circumstances.
An attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability.
Solution:
Install the latest version:
- If you are using Drupal 8.8.x, upgrade to Drupal 8.8.10.
- If you are using Drupal 8.9.x, upgrade to Drupal 8.9.6.
- If you are using Drupal 9.0.x, upgrade to Drupal 9.0.6.
Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.10.
In addition to updating Drupal core, sites that override \Drupal\Core\Form\FormBuilder's renderPlaceholderFormAction() and/or buildFormAction() methods in contrib and/or custom code should ensure that appropriate sanitization is applied for URLs.
Reported By:
- Nuno Ramos
- markwittens
- Nathan Dentzau
- Marc Addeo
- Alejandro Garza
- Drew Webber of the Drupal Security Team
Fixed By:
- Lee Rowlands of the Drupal Security Team
- David Rothstein of the Drupal Security Team
- Wim Leers
- Vijay Mani, provisional member of the Drupal Security Team
- Drew Webber of the Drupal Security Team
- Nathan Dentzau
- Heine of the Drupal Security Team
- Joseph Zhao, provisional member of the Drupal Security Team
- xjm of the Drupal Security Team
- Tim Plunkett
