CVE-2020-13673 Cross-site scripting in Entity Embed
An unprivileged user can inject HTML leading to cross-site scripting when a trusted user views the content, potentially allowing session hijacking or malicious actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-13673?
CVE-2020-13673 is a medium-severity cross-site scripting vulnerability in Drupal Entity Embed, published on 11 Feb 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.
Which versions are affected by CVE-2020-13673?
1 open source package ship an affected version, including drupal/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal/core Packagist | From 8.0.0 | 8.9.19, 9.1.13, 9.2.6 |
Linux distribution packages (1)
drupal/entity_embed Packagist:https://packages.drupal.org/8 | All versions | 1.2.0 |
Products include Drupal Entity Embed.
How do I fix CVE-2020-13673?
Upgrade drupal/core to a fixed version for your release line: 8.9.19, 9.1.13 or 9.2.6.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-13673 being exploited?
There is no known exploitation of CVE-2020-13673 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2021-028, DRUPAL-CORE-2021-006, GHSA-vhmw-c4p7-7jrc.