DRUPAL-CORE-2021-002

En bref

Publiée: 2021-04-21 15:58 UTC
Mise à jour: 2026-09-19 17:43 UTC
CVE: CVE-2020-13672
Alias: BIT-drupal-2020-13672, GHSA-3m36-mjwj-352c

Description

Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. Not all sites and users are affected, but configuration changes to prevent the exploit might be impractical and will vary between sites. Therefore, we recommend all sites update to this release as soon as possible.

Paquets affectés

Paquet	Versions
Packagist · drupal/core	introduced 8.0.0, fixed 8.9.14 ; introduced 9.0.0, fixed 9.0.12 ; introduced 9.1.0, fixed 9.1.7

Références

https://www.drupal.org/sa-core-2021-002 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence