Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions.

- https://www.drupal.org/project/drupal/releases/7.72

  - [Drupal core - Critical - Cross Site Request Forgery -     SA-CORE-2020-004](https://www.drupal.org/sa-core-2020-00     4) / CVE-2020-13663

- https://www.drupal.org/project/drupal/releases/7.71

- https://www.drupal.org/project/drupal/releases/7.70

  - [Drupal core - Moderately critical - Cross Site     Scripting -     SA-CORE-2020-002](https://www.drupal.org/sa-core-2020-00     2) / CVE-2020-11022 / CVE-2020-11023

  - [Drupal core - Moderately critical - Open Redirect -     SA-CORE-2020-003](https://www.drupal.org/sa-core-2020-00     3) / CVE-2020-13662

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.

For Debian 8 'Jessie', this problem has been fixed in version 7.32-1+deb8u18.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.70, 8.7.x prior to 8.7.14 or 8.8.x prior to 8.8.6. It is, therefore, affected by multilple vulnerabilities :

 - Two Cross-Site Scripting (XSS) vulnerabilities in jQuery (CVE-2020-11022 / CVE-2020-11023).

 - An open redirect due to insufficient validation of the destination query parameter in the drupal_goto() function in Drupal 7 only (CVE-2020-13662).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in Drupal, a fully-featured content management framework, which could result in an open redirect or cross-site scripting.

ID	Name	Product	Family	Severity
140557	Fedora 31 : drupal7 (2020-fbb94073a1)	Nessus	Fedora Local Security Checks	high
140545	Fedora 32 : drupal7 (2020-0b32a59b54)	Nessus	Fedora Local Security Checks	high
137572	Debian DLA-2250-1 : drupal7 security update	Nessus	Debian Local Security Checks	medium
112438	Drupal 7.x < 7.70 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112437	Drupal 8.7.x < 8.7.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112430	Drupal 8.8.x < 8.8.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
136932	Debian DSA-4693-1 : drupal7 - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-13662

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium