CVE-2020-13673

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

Score

CVSS 3.1 6.1 Medium

Status

Modified - mlhess@drupal.org

Published

2022-02-11

Last modified

2024-08-04

Weaknesses

CWE-352, CWE-79

Affected products

• Entity Embed (Drupal)

References

• https://www.drupal.org/sa-contrib-2021-028