Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004

Project: Drupal coreDate: 2020-June-17Security risk: Critical 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13663Description: The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.Solution: 

Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.8.Reported By: 

Fixed By: 

Path to article https://www.drupal.org/sa-core-2020-004