CVE-2020-13673

Опубликовано: 11 фев. 2022

Источник: nvd

CVSS3: 6.1

CVSS2: 2.6

EPSS Низкий

Описание

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

Ссылки

https://www.drupal.org/sa-contrib-2021-028
Patch
Vendor Advisory
https://www.drupal.org/sa-contrib-2021-028
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:drupal:entity_embed:8.x-1.0:-:*:*:*:*:*:*

cpe:2.3:a:drupal:entity_embed:8.x-1.0:alpha1:*:*:*:*:*:*

cpe:2.3:a:drupal:entity_embed:8.x-1.0:alpha2:*:*:*:*:*:*

cpe:2.3:a:drupal:entity_embed:8.x-1.0:alpha3:*:*:*:*:*:*

cpe:2.3:a:drupal:entity_embed:8.x-1.0:beta1:*:*:*:*:*:*

cpe:2.3:a:drupal:entity_embed:8.x-1.0:beta2:*:*:*:*:*:*

cpe:2.3:a:drupal:entity_embed:8.x-1.0:beta3:*:*:*:*:*:*

cpe:2.3:a:drupal:entity_embed:8.x-1.0:rc1:*:*:*:*:*:*

cpe:2.3:a:drupal:entity_embed:8.x-1.0:rc2:*:*:*:*:*:*

cpe:2.3:a:drupal:entity_embed:8.x-1.1:*:*:*:*:*:*:*

cpe:2.3:a:drupal:entity_embed:8.x-1.2:*:*:*:*:*:*:*

EPSS

Процентиль: 48%

0.00247

Низкий

6.1 Medium

CVSS3

2.6 Low

CVSS2

Дефекты

CWE-352

CWE-79

Связанные уязвимости

GHSA-vhmw-c4p7-7jrc