tocsin

Packagist/drupal/core CVE-2020-13669: unknown, EPSS 0.74%

Drupal core's built-in CKEditor image caption functionality is vulnerable to XSS.

Action: Upgrade drupal/core to 8.8.10 or later.

composer require drupal/core:8.8.10
composer require drupal/core:8.9.6
composer require drupal/core:9.0.6

Affected

introducedfixedlast affected
8.0.08.8.10-
8.9.08.9.6-
9.0.09.0.6-

Fixed versions

8.8.108.9.69.0.6

Sources

CVE-2020-13669 · published · modified · JSON