Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2020-13673

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
drupal

Description

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Drupal Entity Embed

  • 8.x to < 8.x-1.2affected

References