Anmelden
Deutsch English Español Polski
Nicht bewertet

Drupal core - SA-CORE-2020-002

  • Veröffentlicht: 20.05.2020
  • Aktualisiert: 11.10.2026 13:17

The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are

[...] security issues in jQuery’s DOM manipulation methods, as in .html(), .append(), and the others. Security advisories for both of these issues have been published on GitHub.

Those advisories are:

These vulnerabilities may be exploitable on some Drupal sites. This Drupal security release backports the fixes to the relevant jQuery functions, without making any other changes to the jQuery version that is included in Drupal core or running on the site via some other module such as jQuery Update. It is not necessary to update jquery_update on Drupal 7 sites that have the module installed.

Backwards-compatibility code has also been added to minimize regressions to Drupal sites that might rely on jQuery's prior behavior. With jQuery 3.5, incorrect self-closing HTML tags in JavaScript for elements where end tags are normally required will encounter a change in what jQuery returns or inserts. To minimize that disruption in 8.8.x and earlier, this security release retains jQuery's prior behavior for most safe tags. There may still be regressions for edge cases, including invalidly self-closed custom elements on Internet Explorer.

(Note: the backwards compatibility layer will not be included in the upcoming Drupal 8.9 and 9.0 releases, so Drupal 8 and 9 modules, themes, and sites should correct tags in JavaScript to properly use closing tags.)

If you find a regression caused by the jQuery changes, please report it in Drupal core's issue queue (or that of the relevant contrib project). However, if you believe you have found a security issue, please report it privately to the Drupal Security Team.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

PlattformPaketAnfällige VersionenBehoben in
Composer-Paket drupal/core >= 8.0.0, < 8.7.14, >= 8.8.0, < 8.8.6 8.7.14, 8.8.6
Drupal (Kern) drupal/core >= 8.0.0, < 8.7.14, >= 8.8.0, < 8.8.6 8.7.14, 8.8.6

Verweise

CVSS-Wert -
Schwäche (CWE)
-
Plattform
Composer, Drupal
Paket
drupal/core
Veröffentlicht
20.05.2020
Aktualisiert
11.10.2026 13:17

Quellen und Lizenzen

OSV / GitHub Advisory Database - DRUPAL-CORE-2020-002 - CC BY-SA 2.0; code GPL-2.0-or-later

Schwachstellenhistorie: drupal/core

Alle veröffentlichten Schwachstellen dieses Pakets (Drupal (Kern)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (165) im Archiv
Einträge insgesamt
165
Erste → letzte
02.2018 09.2026
Ohne Fix
3
In Angriffen ausgenutzt
5

Verteilung nach Schweregrad

  • Kritisch 17
  • Hoch 44
  • Mittel 72
  • Niedrig 6
  • Nicht bewertet 26

Veröffentlichungen pro Jahr

Schweregrad:
  1. Drupal core - SA-CORE-2020-002 dieser Eintrag
    Nicht bewertet drupal-core-2020-002 >= 8.0.0, < 8.7.14, >= 8.8.0, < 8.8.6 8.7.14, 8.8.6
  2. Drupal Core has a SQL Injection issue
    Kritisch · 9.8 In Angriffen ausgenutzt CVE-2026-9082 >= 8.9.0, < 10.4.10, >= 10.5.0, < 10.5.10, >= 10.6.0, < 10.6.9, >= 11.0.0, < 11.1.10, >= 11.2.0, < 11.2.12, >= 11.3.0, < 11.3.10 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10
  3. Drupal core contains a potential PHP Object Injection vulnerability
    Hoch · 9.8 CVE-2024-55638 >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 7.0, < 7.102, >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 7.0, < 7.102, >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 7.0, < 7.102 10.2.11, 10.3.9, 7.102
  4. Drupal core contains a potential PHP Object Injection vulnerability
    Hoch · 9.8 CVE-2024-55637 >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 11.0.0, < 11.0.8, >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 11.0.0, < 11.0.8, >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 11.0.0, < 11.0.8 10.2.11, 10.3.9, 11.0.8
  5. Drupal core Arbitrary PHP code execution
    Hoch · 7.8 ghsa-j66p-fvp2-fxhj >= 7.0.0, < 7.75, >= 8.0.0, < 8.8.12, >= 8.9.0, < 8.9.10, >= 9.0.0, < 9.0.9 7.75, 8.8.12, 8.9.10, 9.0.9
  6. Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
    Hoch · 8.1 ghsa-m9fv-whq2-6wmc >= 7.0.0, < 7.69, >= 8.0.0, < 8.7.11, >= 8.8.0, < 8.8.1 7.69, 8.7.11, 8.8.1
  7. Drupal core Remote Code Execution
    Kritisch ghsa-jf8c-36vw-98x4 >= 7.0, < 7.60, >= 8.0.0, < 8.5.8, >= 8.6.0, < 8.6.2 7.60, 8.5.8, 8.6.2
  8. Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
    Kritisch ghsa-jjx7-8462-w4m4 >= 8.0.0, < 8.5.8, >= 8.6.0, < 8.6.2 8.5.8, 8.6.2
  9. Drupal core Arbitrary PHP code execution
    Hoch · 7.8 ghsa-gxxj-g9v8-w28p >= 7.0.0, < 7.75, >= 8.0.0, < 8.8.12, >= 8.9.0, < 8.9.10, >= 9.0.0, < 9.0.9 7.75, 8.8.12, 8.9.10, 9.0.9
  10. Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
    Hoch · 8.1 ghsa-98h9-727m-44qv >= 7.0.0, < 7.69, >= 8.0.0, < 8.7.11, >= 8.8.0, < 8.8.1 7.69, 8.7.11, 8.8.1
  11. Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
    Kritisch ghsa-7v68-3pr5-h3cr >= 8.0.0, < 8.5.8, >= 8.6.0, < 8.6.2 8.5.8, 8.6.2
  12. Drupal core Remote Code Execution
    Kritisch ghsa-6mgp-v5cm-ghg5 >= 7.0, < 7.60, >= 8.0.0, < 8.5.8, >= 8.6.0, < 8.6.2 7.60, 8.5.8, 8.6.2
  13. Drupal core - SA-CORE-2024-001
    Hoch · 7.5 CVE-2024-11941 >= 8.0.0, < 10.1.8, >= 10.2.0, < 10.2.2 10.1.8, 10.2.2
  14. Drupal core - SA-CORE-2023-006
    Kritisch CVE-2023-5256 >= 8.7.0, < 9.5.11, >= 10.0.0, < 10.0.11, >= 10.1.0, < 10.1.4 9.5.11, 10.0.11, 10.1.4
  15. Drupal core - SA-CORE-2023-005
    Kritisch CVE-2023-31250 >= 8.0.0, < 9.4.14, >= 9.5.0, < 9.5.8, >= 10.0.0, < 10.0.8 9.4.14, 9.5.8, 10.0.8
  16. Drupal core - SA-CORE-2022-016
    Hoch · 7.5 CVE-2022-39261 >= 8.0.0, < 9.3.22, >= 9.4.0, < 9.4.7 9.3.22, 9.4.7
  17. Drupal core - SA-CORE-2022-014
    Hoch · 7.2 CVE-2022-25277 >= 8.0.0, < 9.3.19, >= 9.4.0, < 9.4.3 9.3.19, 9.4.3
  18. Drupal core - SA-CORE-2022-012
    Hoch · 7.5 CVE-2022-25275 >= 8.0.0, < 9.3.19, >= 9.4.0, < 9.4.3 9.3.19, 9.4.3
  19. Drupal core - SA-CORE-2022-011
    Hoch · 7.5 CVE-2022-31042 >= 8.0.0, < 9.2.21, >= 9.3.0, < 9.3.16 9.2.21, 9.3.16
  20. Drupal core - SA-CORE-2022-010
    Hoch · 8.0 CVE-2022-29248 >= 8.0.0, < 9.2.20, >= 9.3.0, < 9.3.14 9.2.20, 9.3.14
  21. Drupal has open redirect vulnerability in the Overlay module
    Hoch · 7.5 CVE-2013-6389 >= 7.0, < 7.24 7.24
  22. Drupal Access Control Bypass
    Hoch CVE-2011-2687 >= 7.0, < 7.3 7.3
  23. Drupal Open Redirect
    Hoch · 7.4 CVE-2016-3164 >= 6.0, < 6.38, >= 7.0, < 7.43, >= 8.0, < 8.0.4, >= 8.0, < 8.0.4, >= 7.0, < 7.43, >= 6.0, < 6.38 6.38, 7.43, 8.0.4
  24. Drupal Form API ignores access restrictions on submit buttons
    Hoch · 7.5 CVE-2016-3165 >= 6.0, < 6.38, >= 6.0, < 6.38 6.38
  25. Drupal saving user accounts can sometimes grant the user all roles
    Hoch · 8.1 CVE-2016-3169 >= 6.0, < 6.38, >= 7.0, < 7.43, >= 7.0, < 7.43, >= 6.0, < 6.38 6.38, 7.43
  26. Drupal Brute force amplification attacks via XML-RPC
    Hoch · 7.5 CVE-2016-3163 >= 7.0, < 7.43, >= 6.0, < 6.38, >= 7.0, < 7.43, >= 6.0, < 6.38 7.43, 6.38
  27. Drupal Open redirect vulnerability in the drupal_goto function
    Hoch · 7.4 CVE-2016-3167 >= 6.0, < 6.38, >= 6.0, < 6.38 6.38
  28. Drupal File upload access bypass and denial of service
    Hoch · 8.1 CVE-2016-3162 >= 7.0, < 7.43, >= 8.0, < 8.0.4, >= 8.0, < 8.0.4, >= 7.0, < 7.43 7.43, 8.0.4
  29. Drupal arbitrary code execution
    Hoch · 8.1 CVE-2016-3171 >= 6.0, < 6.38, >= 6.0, < 6.38 6.38
  30. Drupal Saving user accounts can sometimes grant the user all roles
    Hoch · 8.8 CVE-2016-6211 >= 7.0, < 7.44, >= 7.0, < 7.44 7.44
  31. Drupal Incorrect cache context on password reset page
    Hoch · 7.5 CVE-2016-9450 >= 8.0, < 8.2.3, >= 8.0, < 8.2.3 8.2.3
  32. Drupal Cross-Site Request Forgery (CSRF)
    Hoch · 7.5 CVE-2017-6379 >= 8.2.0, < 8.2.7, >= 8.2.0, < 8.2.7 8.2.7
  33. Drupal Node Validation Bypass in the node module API
    Hoch CVE-2008-4793 >= 5.0, < 5.11 5.11
  34. Drupal Comment reply form allows access to restricted content
    Hoch · 8.1 CVE-2017-6926 >= 8.4.0, < 8.4.5, >= 7.0, < 7.57, >= 8.4.0, < 8.4.5, >= 7.0, < 7.57 8.4.5, 7.57
  35. Drupal PECL YAML parser unsafe object handling
    Kritisch · 9.8 CVE-2017-6920 >= 8.0, < 8.3.4, >= 8.0, < 8.3.4 8.3.4
  36. Drupal access control bypass vulnerability
    Hoch · 7.5 CVE-2017-6919 >= 8.0, < 8.2.8, >= 8.3.0, < 8.3.1, >= 8.0, < 8.2.8, >= 8.3.0, < 8.3.1 8.2.8, 8.3.1
  37. Drupal access bypass vulnerability
    Hoch · 8.1 CVE-2017-6930 >= 8.4.0, < 8.4.5, >= 8.4.0, < 8.4.5 8.4.5
  38. Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
    Kritisch · 9.8 CVE-2017-6925 >= 8.0, < 8.3.7, >= 8.0, < 8.3.7 8.3.7
  39. Drupal Remote code execution
    Hoch · 8.1 CVE-2017-6381 >= 8.0, < 8.2.7, >= 8.0, < 8.2.7 8.2.7
  40. Drupal editor module incorrectly checks access to inline private files
    Hoch · 7.5 CVE-2017-6377 >= 8.2.0, < 8.2.7, >= 8.2.0, < 8.2.7 8.2.7
  41. Drupal REST API can bypass comment approval
    Hoch · 7.4 CVE-2017-6924 >= 8.0, < 8.3.7, >= 8.0, < 8.3.7 8.3.7
Mehr anzeigen (20) 41 von 62 angezeigt

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden
DockRay Newsletter

Anwendungssicherheit in Ihrem Postfach

Wichtige Schwachstellen, konkrete Empfehlungen und praktische Tipps für Ihre Anwendungen. Wählen Sie Ihre Technologien und verfolgen Sie, was für Ihr Projekt relevant ist.

  • Eine tägliche Zusammenfassung neuer Schwachstellen, auch kritischer.
  • Benachrichtigungen über wichtige Updates.
  • Praktische Tipps zur Sicherheit und Überwachung von Anwendungen.

Leer lassen, um Meldungen zu allen Technologien zu erhalten.

Datenschutzerklärung

Kostenlos anmelden. In jeder E-Mail mit einem Klick abmelden.