A document object model-based cross-site scripting (DOM XSS) attack is achievable if a webenters data to the DOM without being appropriately sanitized. Drupal acknowledged and patched the, assigning it CVE-2020-13663. An attacker abusing thiscan take over the administrator role of a Drupal-based website and get full control that allows changing of content, creating malicious links, stealing sensitive or financial data, or whatever else comes to mind. The CheckmarxResearch Team found that every maintained version of Drupal (7.x, 8.8.9.x) were easily exploitable by the same techniques.”]
Source: https://checkmarx.com/blog/its-time-to-update-your-drupal-now/