View online: https://www.drupal.org/sa-core-2020-004

Project: Drupal core [1] Date: 2020-June-17 Security risk: *Critical* 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery

CVE IDs: CVE-2020-13663 Description:  The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.

Solution:  * If you are using Drupal 7.x, upgrade to Drupal 7.72 [3]. * If you are using Drupal 8.8.x, upgrade to Drupal 8.8.8 [4]. * If you are using Drupal 8.9.x, upgrade to Drupal 8.9.1 [5]. * If you are using Drupal 9.0.x, upgrade to Drupal 9.0.1 [6].

Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.8.

Reported By:  * Samuel Mortenson [7] of the Drupal Security Team * Dor Tumarkin [8]

Fixed By:  * Greg Knaddison [9] of the Drupal Security Team * Samuel Mortenson [10] of the Drupal Security Team * Jess [11] of the Drupal Security Team * Lee Rowlands [12] of the Drupal Security Team * Angie Byron [13] of the Drupal Security Team * Peter Wolanin [14] of the Drupal Security Team * Daniel Wehner [15] * Dor Tumarkin [16] * Drew Webber [17] of the Drupal Security Team * Alex Pott [18] of the Drupal Security Team * David Snopek [19] of the Drupal Security Team

[1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/7.72 [4] https://www.drupal.org/project/drupal/releases/8.8.8 [5] https://www.drupal.org/project/drupal/releases/8.9.1 [6] https://www.drupal.org/project/drupal/releases/9.0.1 [7] https://www.drupal.org/user/2582268 [8] https://www.drupal.org/user/3648639 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/2582268 [11] https://www.drupal.org/user/65776 [12] https://www.drupal.org/user/395439 [13] https://www.drupal.org/user/24967 [14] https://www.drupal.org/user/49851 [15] https://www.drupal.org/user/99340 [16] https://www.drupal.org/user/3648639 [17] https://www.drupal.org/user/255969 [18] https://www.drupal.org/user/157725 [19] https://www.drupal.org/user/266527