---
title: "CX-2020-4283"
date: "2020-12-02T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2020-4283/"
---

# CX-2020-4283

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Sep 16, 2020

CVE-2020-13669  **Published:** Dec 2, 2020

CWE-79 CWE-79 Cross-site Scripting (XSS)  6.1 Medium Severity Drupal php XSS

DT Dor Tumarkin  Reported by Checkmarx Zero

Details Overview

## Summary

Drupal core’s built-in CKEditor image caption functionality is vulnerable to XSS.

## Product

Drupal before 8.8.10.  
Drupal 8.9.x before 8.9.6.  
Drupal 9.0.x before 9.0.6.

## Impact

This can cause malicious code to run on the victim’s browser, which can lead to the hijacking of user accounts, injecting arbitrary web-content as malicious login or payment forms, defacing a page to hide its contents and redirect users to a website of an attacker’s choice.

## Steps to reproduce

In any vulnerable version of Drupal Core, copy the following payload into a CKEditor instance and switch to an HTML view (in vanilla Drupal Core, by clicking the “Source” button).

```html
<img data-caption="&lt;script&gt;alert('XSS by Checkmarx')&lt;/script&gt;"
     data-entity-uuid="2"
     data-entity-type="1" src="x" />
```

### Expected result:

`<script>alert('XSS by Checkmarx')</script>` will be loaded in victim’s browser.

## Remediation

If you are using Drupal before 8.8.10, update to Drupal 8.8.10 and above.  
If you are using Drupal 8.9.x, update to Drupal 8.9.6 and above.  
If you are using Drupal 9.0.x, update to Drupal 9.0.6 and above.

## Credit

This issue was discovered and reported by Checkmarx Security Researcher Dor Tumarkin.

## Resources

1. [Blog](https://www.checkmarx.com/blog/drupal-core-behind-the-vulnerability-part-2-defacement-stored-xss-and-self-xss/)
2. [Advisory](https://www.drupal.org/sa-core-2020-010)
3. Commit [dff7a09](https://github.com/drupal/drupal/commit/dff7a09d243e833ba3b7a28091f78e9c6200e43d)

0  Medium Severity CVSS v3.1 Score

   6.1

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

Advisory Timeline1. Discovered Jun 18, 2020 Notified Drupal Security Team
2. Fixed Sep 16, 2020 Drupal Core new sub-versions release across all major versions

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)