Patchwire CVEs, their patch status, and feeds to follow them

CVE-2020-13666

Fixed in a distro release EPSS 3%

Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

Published 2021-05-05 · CVE record · OSV

Products: Drupal Core

Fixed upstream

EcosystemPackageFixed in
Packagistdrupal/core8.8.10
Packagistdrupal/core8.9.6
Packagistdrupal/core9.0.6
Packagistdrupal/core7.73
Packagistdrupal/drupal7.73
Packagistdrupal/drupal8.8.10
Packagistdrupal/drupal8.9.6
Packagistdrupal/drupal9.0.6

Distro releases

ReleasePackageFixed in
Debian 9drupal77.52-2+deb9u12
Ubuntu Pro 14.04 LTSdrupal7no fix
Ubuntu Pro 16.04 LTSdrupal7no fix