CVE-2020-13673

Summary

CVE	CVE-2020-13673
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-02-11 16:15:00 UTC
Updated	2022-07-25 10:26:00 UTC
Description	The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

Risk And Classification

Problem Types: CWE-79

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Drupal	Entity Embed	8.x-1.0	-	All	All
Application	Drupal	Entity Embed	8.x-1.0	alpha1	All	All
Application	Drupal	Entity Embed	8.x-1.0	alpha2	All	All
Application	Drupal	Entity Embed	8.x-1.0	alpha3	All	All
Application	Drupal	Entity Embed	8.x-1.0	beta1	All	All
Application	Drupal	Entity Embed	8.x-1.0	beta2	All	All
Application	Drupal	Entity Embed	8.x-1.0	beta3	All	All
Application	Drupal	Entity Embed	8.x-1.0	rc1	All	All
Application	Drupal	Entity Embed	8.x-1.0	rc2	All	All
Application	Drupal	Entity Embed	8.x-1.1	All	All	All
Application	Drupal	Entity Embed	8.x-1.2	All	All	All

References

Reference	Source	Link	Tags
Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028 \| Drupal.org	CONFIRM	www.drupal.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

730199 Drupal Core Multiple Vulnerabilities (SA-CORE-2021-006 - SA-CORE-2021-010)
730200 Drupal Core Cross-Site Request Forgery (CSRF) Vulnerability (SA-CORE-2021-006)