Access bypass in Drupal Core 8/9
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Why it matters now
EPSS 0.00787 56th percentileScored 2026-11-07
Fix Fixed Core (Drupal): 8.8.10, 8.9.6, 9.0.6drupal/core (Packagist): 8.8.10, 8.9.6, 9.0.6+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Drupal | Core | 8.8.x to before 8.8.10; 8.9.x to before 8.9.6; 9.0.x to before 9.0.6 | 8.8.10, 8.9.6, 9.0.6 | Patch available | CNA |
| — | drupal/core (Packagist) | 8.0.0 to before 8.8.10 | 8.8.10 | Patch available | GHSA-m6q5-wv4x-fv6h |
| — | drupal/core (Packagist) | 8.9.0 to before 8.9.6 | 8.9.6 | Patch available | GHSA-m6q5-wv4x-fv6h |
| — | drupal/core (Packagist) | 9.0.0 to before 9.0.6 | 9.0.6 | Patch available | GHSA-m6q5-wv4x-fv6h |
| — | drupal/drupal (Packagist) | 8.0.0 to before 8.8.10 | 8.8.10 | Patch available | GHSA-m6q5-wv4x-fv6h |
| — | drupal/drupal (Packagist) | 8.9.0 to before 8.9.6 | 8.9.6 | Patch available | GHSA-m6q5-wv4x-fv6h |
| — | drupal/drupal (Packagist) | 9.0.0 to before 9.0.6 | 9.0.6 | Patch available | GHSA-m6q5-wv4x-fv6h |
- Core VendorDrupal Affected 8.8.x to before 8.8.10; 8.9.x to before 8.9.6; 9.0.x to before 9.0.6 Fixed in 8.8.10, 8.9.6, 9.0.6 Patch available CNA
- drupal/core (Packagist) Vendor— Affected 8.0.0 to before 8.8.10 Fixed in 8.8.10 Patch available GHSA-m6q5-wv4x-fv6h
- drupal/core (Packagist) Vendor— Affected 8.9.0 to before 8.9.6 Fixed in 8.9.6 Patch available GHSA-m6q5-wv4x-fv6h
- drupal/core (Packagist) Vendor— Affected 9.0.0 to before 9.0.6 Fixed in 9.0.6 Patch available GHSA-m6q5-wv4x-fv6h
- drupal/drupal (Packagist) Vendor— Affected 8.0.0 to before 8.8.10 Fixed in 8.8.10 Patch available GHSA-m6q5-wv4x-fv6h
- drupal/drupal (Packagist) Vendor— Affected 8.9.0 to before 8.9.6 Fixed in 8.9.6 Patch available GHSA-m6q5-wv4x-fv6h
- drupal/drupal (Packagist) Vendor— Affected 9.0.0 to before 9.0.6 Fixed in 9.0.6 Patch available GHSA-m6q5-wv4x-fv6h
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* | 8.8.0 to before 8.8.10; 8.9.0 to before 8.9.6; 9.0.0 to before 9.0.6 | Vulnerable | Drupal |
- cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 8.8.0 to before 8.8.10; 8.9.0 to before 8.9.6; 9.0.0 to before 9.0.6 Vulnerable ·Drupal
Remediation
- Fix · CNA Core (Drupal) Fixed in 8.8.10, 8.9.6, 9.0.6
- Fix · GHSA-m6q5-wv4x-fv6h drupal/core (Packagist) Fixed in 8.8.10 Advisory →
- Fix · GHSA-m6q5-wv4x-fv6h drupal/core (Packagist) Fixed in 8.9.6 Advisory →
- Fix · GHSA-m6q5-wv4x-fv6h drupal/core (Packagist) Fixed in 9.0.6 Advisory →
- Fix · GHSA-m6q5-wv4x-fv6h drupal/drupal (Packagist) Fixed in 8.8.10 Advisory →
- Fix · GHSA-m6q5-wv4x-fv6h drupal/drupal (Packagist) Fixed in 8.9.6 Advisory →
- Fix · GHSA-m6q5-wv4x-fv6h drupal/drupal (Packagist) Fixed in 9.0.6 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Drupal Core 8.8.10, 8.9.6, 9.0.6
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2020-10730 Exposure of resource to wrong sphere in Drupal CorePriority LOW 35
- TI-2020-10729 Cross-site scripting in Drupal CorePriority LOW 29
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-13668
- 2026-10-03 Alias added: GHSA-m6q5-wv4x-fv6h
References
Other 6
- https://github.com/drupal/core/commit/3184fa4b2f3b65b44884b5e858cdc7794d34b4c8
- https://github.com/drupal/core/commit/58330ba58d1ac6f1a0a549e8dbde8a3e094bf4fb
- https://github.com/drupal/core/commit/d4be028d81fb6b067513d788b60c3e6fc8fbd0a2
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13668.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13668.yaml
- https://github.com/drupal/core
More Drupal vulnerabilities
- TI-2026-07979 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05494 Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05493 Improper input validation in Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-10731 Unrestricted file upload in Drupal Core KEVCVSS 3.1HIGH 8.8
- TI-2019-04505 Drupal core - Highly critical - Remote Code Execution KEVCVSS 3.1HIGH 8.1
- TI-2020-17477 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks… KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2020-13668 · CVE Program
- CVE-2020-13668 · NVD
- FIRST EPSS
- GHSA-m6q5-wv4x-fv6h · GitHub Advisory Database · CC BY 4.0
- CVE-2020-13668 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences