The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to cross-site scripting.
CVE-2020-13673
This vulnerability affects the following application versions:
- Drupal 8.8.0
- Drupal 8.8.1
- Drupal 8.8.2
- Drupal 8.8.3
- Drupal 8.8.4
- Drupal 8.8.5
- Drupal 8.8.6
- Drupal 8.8.7
- Drupal 8.8.8
- Drupal 8.8.9
- Drupal 8.8.10
- Drupal 8.8.11
- Drupal 8.8.12
- Drupal 8.9.0
- Drupal 8.9.1
- Drupal 8.9.2
- Drupal 8.9.3
- Drupal 8.9.4
- Drupal 8.9.5
- Drupal 8.9.6
- Drupal 8.9.7
- Drupal 8.9.8
- Drupal 8.9.9
- Drupal 8.9.10
- Drupal 8.9.11
- Drupal 8.9.12
- Drupal 8.9.13
- Drupal 8.9.14
- Drupal 8.9.15
- Drupal 8.9.16
- Drupal 8.9.17
- Drupal 8.9.18
- Drupal 9.0.0
- Drupal 9.0.1
- Drupal 9.0.2
- Drupal 9.0.3
- Drupal 9.0.4
- Drupal 9.0.5
- Drupal 9.0.6
- Drupal 9.0.7
- Drupal 9.0.8
- Drupal 9.0.9
- Drupal 9.0.10
- Drupal 9.0.11
- Drupal 9.0.12
- Drupal 9.0.13
- Drupal 9.0.14
- Drupal 9.1.0
- Drupal 9.1.1
- Drupal 9.1.2
- Drupal 9.1.3
- Drupal 9.1.4
- Drupal 9.1.5
- Drupal 9.1.6
- Drupal 9.1.7
- Drupal 9.1.8
- Drupal 9.1.9
- Drupal 9.1.10
- Drupal 9.1.11
- Drupal 9.1.12
- Drupal 9.2.0
- Drupal 9.2.1
- Drupal 9.2.2
- Drupal 9.2.3
- Drupal 9.2.4
- Drupal 9.2.5