Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade drupal7 | Aug 22, 2024 | May 5, 2021 |
| Debian | — | Upgrade drupal7 | Nov 20, 2020 | Nov 20, 2020 |
| Drupal | — | Upgrade to drupal version 9.0.6Upgrade to drupal version 7.73Upgrade to drupal version 8.9.6Upgrade to drupal version 8.8.1 | Sep 17, 2020 | Sep 17, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 5, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub