CVE-2020-13662: Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002
Other sources
Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 7.70 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 7.70 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.7.14 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.8.6 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.7.14 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.8.6 - Upgrade
Upgrade
alpine/drupal7to a version that resolves this vulnerability.Fixed in 7.70-r0
Event History
Frequently Asked Questions
What is the vulnerability ID for this Drupal core vulnerability?
The vulnerability ID for this Drupal core vulnerability is CVE-2020-13662.
What is the severity of CVE-2020-13662?
CVE-2020-13662 is classified as Moderately critical.
What is the type of vulnerability in CVE-2020-13662?
CVE-2020-13662 is a Cross Site Scripting (XSS) vulnerability.
Which versions of Drupal Core are affected by CVE-2020-13662?
Drupal Core 7 version 7.70 and prior versions are affected by CVE-2020-13662.
How can I fix the vulnerability in Drupal Core CVE-2020-13662?
To fix the vulnerability in Drupal Core CVE-2020-13662, you should update Drupal Core to version 7.71 or apply the necessary patches provided by Drupal.