--- title: "CX-2020-4282" date: "2020-11-19T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2020-4282/" --- # CX-2020-4282 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Jun 17, 2020 CVE-2020-13663 **Published:** Nov 19, 2020 6.1 Medium Severity Drupal php XSS DT Dor Tumarkin Reported by Checkmarx Zero Details Overview ## Summary A reflected DOM-based XSS was identified in Drupal Core. This allows an attacker to craft a web-page which, when accessed by an authenticated Drupal user with content writing permissions, would send a request to either an `edit node` or `add node` endpoint on that user’s behalf. While this form would not contain valid tokens and be prevented from performing the `edit` or `add` actions, the resulting web-page would still reflect this content in the victim’s browser, and the application DOM would populate a CKEditor WYSWIG frame with the attacker’s HTML. ## Product Drupal Core before 7.72. Drupal Core 8.x before 8.8.8. Drupal Core 8.9.x before 8.9.1. Drupal Core 9.0.x before 9.0.1. ## Impact This can cause malicious code to run on the victim’s browser, which can lead to the hijacking of user accounts and inject arbitrary web-content as malicious login or payment forms. ## Steps to reproduce In any vulnerable version of Drupal Core, using the Basic Page functioniality and URL rewrites are not changed, an authenticate user with permissions to add the page and use a Full HTML mode will execute: ```html

``` ### Expected result: ```html ``` Will be loaded in the victim’s browser. ## Remediation If you are using Drupal Core before 7.72, update to 7.72 and above. If you are using Drupal Core 8.x, update to 8.8.8 and above. If you are using Drupal Core 8.9.x, update to 8.9.1 and above. If you are using Drupal Core 9.0.x, update to 9.0.1 and above. ## Credit This issue was discovered and reported by: Checkmarx Security Researcher Dor Tumarkin. Samuel Mortenson of the Drupal Security Team. ## Resources 1. [Blog](https://www.checkmarx.com/blog/drupal-core-behind-the-vulnerability-part-1-reflected-xss/) 2. [Advisory](https://www.drupal.org/sa-core-2020-004) 3. [bc3235d](https://github.com/drupal/core/commit/bc3235dcb5570bbda62ef9547e7604ee060b72c6) 0 Medium Severity CVSS v3.1 Score 6.1 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None Advisory Timeline1. Discovered Jun 7, 2020 Notified via e-mail 2. Fixed Jun 17, 2020 New sub-versions release across all major version ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)