CVE-2020-13666

Name of the Vulnerable Software and Affected Versions Drupal Core versions prior to 7.73 Drupal Core 8.8.x versions prior to 8.8.10 Drupal Core 8.9.x versions prior to 8.9.6 Drupal Core 9.0.x versions prior to 9.0.6

Description The issue is related to a cross-site scripting vulnerability in Drupal Core, where the Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This can potentially impact the integrity of data.

Recommendations For versions prior to 7.73, update to version 7.73 or later. For 8.8.x versions prior to 8.8.10, update to version 8.8.10 or later. For 8.9.x versions prior to 8.9.6, update to version 8.9.6 or later. For 9.0.x versions prior to 9.0.6, update to version 9.0.6 or later.