Vulnerability Details CVE-2020-13673
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 52.0%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 2.6
Products affected by CVE-2020-13673
-
cpe:2.3:a:drupal:entity_embed:8.x-1.0
-
cpe:2.3:a:drupal:entity_embed:8.x-1.1
-
cpe:2.3:a:drupal:entity_embed:8.x-1.2