CVE-2020-13663: Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004
Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
Other sources
Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 9.0.1 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.9.1 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.8.8 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 7.72 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.8.8 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 7.72 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 9.0.1 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.9.1 - Upgrade
Upgrade
alpine/drupal7to a version that resolves this vulnerability.Fixed in 7.72-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2020-13663?
CVE-2020-13663 is classified as a Critical Cross Site Request Forgery vulnerability in Drupal.
How do I fix CVE-2020-13663?
To fix CVE-2020-13663, you should upgrade your Drupal installation to versions 7.72, 8.8.8, 8.9.1, or 9.0.1.
Which versions of Drupal are affected by CVE-2020-13663?
CVE-2020-13663 affects Drupal versions 7.0.0 to 7.71, 8.0.0 to 8.1.0, 8.1.0 to 8.2.0, 8.2.0 to 8.3.0, 8.3.0 to 8.4.0, 8.4.0 to 8.5.0, 8.5.0 to 8.6.0, 8.6.0 to 8.7.0, 8.7.0 to 8.8.0, 8.8.0 to 8.8.8, 8.9.0 to 8.9.1, and 9.0.0 to 9.0.1.
What type of vulnerability is CVE-2020-13663?
CVE-2020-13663 is a Cross Site Request Forgery (CSRF) vulnerability in the Drupal Core Form API.
What issues could arise from CVE-2020-13663?
If exploited, CVE-2020-13663 can lead to unauthorized actions being performed through cross-site requests, potentially leading to further vulnerabilities.