Skip to content
Log inStart free trial

DRUPAL-CORE-2021-006 CVE-2020-13673 DRUPAL-CONTRIB-2021-028

This advisory addresses a similar issue to [Drupal core - Moderately critical - Cross Site Request Forgery -…

Not rated yet Packagist
Severity
Not rated yet
No source has published a CVSS score yet
Exploit chance (EPSS)
0.26%
Chance of exploitation in the next 30 days. Higher than 17.59% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
—
Not classified
Fix
Available
2 packages have a fixed version

Description

The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to cross-site scripting.

This advisory is not covered by Drupal Steward.

Also see Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028 which addresses a similar vulnerability for that module.

Updated 18:15 UTC to clarify text.

Affected versions

Packagist

PackageVulnerableFixed in
drupal/core
>= 8.0.0, < 8.9.19
>= 9.1.0, < 9.1.13
>= 9.2.0, < 9.2.6
8.9.19
9.1.13
9.2.6

Packagist:https://packages.drupal.org/8

PackageVulnerableFixed in
drupal/entity_embed
< 1.2.0
1.2.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

drupal/core Packagist → 9.2.6

composer
composer require drupal/core:^9.2.6

drupal/entity_embed Packagist:https://packages.drupal.org/8 → 1.2.0

composer
composer require drupal/entity_embed:^1.2.0

References

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Critical Known exploited Also affects drupal/core
CVE-2020-28949
Multiple vulnerabilities through filename manipulation in Archive_Tar
High Known exploited Also affects drupal/core
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
High Known exploited Also affects drupal/core
CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
High Known exploited Also affects drupal/core
CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Critical Known exploited Also affects drupal/core
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Critical Known exploited Also affects drupal/core
DRUPAL-CORE-2026-016
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
Not rated yet Also affects drupal/core
DRUPAL-CORE-2026-015
The Drupal core Link module provides a field type that can be used for internal and external URLs.
Not rated yet Also affects drupal/core

Credits: Aaron Zinck

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor