Patchwire CVEs, their patch status, and feeds to follow them

CVE-2020-13672

Fixed in a distro release EPSS <1%

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Published 2022-02-11 · CVE record · OSV

Products: Drupal core

Fixed upstream

EcosystemPackageFixed in
Packagistdrupal/core8.9.14
Packagistdrupal/core9.0.12
Packagistdrupal/core9.1.7
Packagistdrupal/core7.80
Packagistdrupal/drupal7.80
Packagistdrupal/drupal8.9.14
Packagistdrupal/drupal9.0.12
Packagistdrupal/drupal9.1.7

Distro releases

ReleasePackageFixed in
Arch Linuxdrupal9.1.7-1
Debian 9drupal77.52-2+deb9u15
Ubuntu Pro 14.04 LTSdrupal7no fix
Ubuntu Pro 16.04 LTSdrupal7no fix