CVE-2020-13663
Fixed in a distro release EPSS <1%
Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
Products: Drupal Core
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | drupal/core | 8.8.8 |
| Packagist | drupal/core | 8.9.1 |
| Packagist | drupal/core | 9.0.1 |
| Packagist | drupal/core | 7.72 |
| Packagist | drupal/drupal | 7.72 |
| Packagist | drupal/drupal | 8.8.8 |
| Packagist | drupal/drupal | 8.9.1 |
| Packagist | drupal/drupal | 9.0.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 8 | drupal7 | 7.32-1+deb8u19 |
| Debian 9 | drupal7 | 7.52-2+deb9u11 |
| Ubuntu Pro 14.04 LTS | drupal7 | no fix |
| Ubuntu Pro 16.04 LTS | drupal7 | no fix |