CVE-2020-13666

Cross-site scripting vulnerability in Drupal Core

published May 5, 2021

CVSS
—
EPSS
3%
Percentile
87.0
In the wild
Unconfirmed
What it is

Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02925 · 87.0th percentile
Published
2021-05-05T13:50Z
EPSS history
Timeline
  • 05 MAY 13:50Z
    Cross-site scripting vulnerability in Drupal Core
    cvelistv5