{"action":"Upgrade drupal/core to 7.72 or later.","affected":[{"fixed":"8.9.1","introduced":"8.9.0"},{"fixed":"9.0.1","introduced":"9.0.0"},{"fixed":"7.72","introduced":"7.0.0"},{"fixed":"8.8.8","introduced":"8.0.0"}],"component":"drupal/core","cve_ids":["CVE-2020-13663"],"ecosystem":"Packagist","epss":0.00695,"exploited":false,"fixed_versions":["8.9.1","9.0.1","7.72","8.8.8"],"ghsa_id":"GHSA-m648-hpf8-qcjw","id":"tcs_01M5KF573NXKXG92YX4AEJC87X","modified_at":"2025-12-10T23:41:22.346590Z","published_at":"2022-05-24T19:05:06Z","references":["https://osv.dev/vulnerability/GHSA-m648-hpf8-qcjw","https://nvd.nist.gov/vuln/detail/CVE-2020-13663","https://github.com/drupal/core/commit/5f3c4d80fd77df0cfa87722b446db54040d55693","https://github.com/drupal/core/commit/bc3235dcb5570bbda62ef9547e7604ee060b72c6","https://github.com/drupal/core/commit/faf3243c4ce03bbaab386af2b272b363fd0dfddb","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13663.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13663.yaml","https://github.com/drupal/core","https://www.drupal.org/sa-core-2020-004"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-m648-hpf8-qcjw","url":"https://osv.dev/vulnerability/GHSA-m648-hpf8-qcjw"}],"summary":"Drupal Core Cross-Site Request Forgery (CSRF) vulnerability"}