Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.

- https://www.drupal.org/project/drupal/releases/7.72

  - [Drupal core - Critical - Cross Site Request Forgery -     SA-CORE-2020-004](https://www.drupal.org/sa-core-2020-00     4) / CVE-2020-13663

- https://www.drupal.org/project/drupal/releases/7.71

- https://www.drupal.org/project/drupal/releases/7.70

  - [Drupal core - Moderately critical - Cross Site     Scripting -     SA-CORE-2020-002](https://www.drupal.org/sa-core-2020-00     2) / CVE-2020-11022 / CVE-2020-11023

  - [Drupal core - Moderately critical - Open Redirect -     SA-CORE-2020-003](https://www.drupal.org/sa-core-2020-00     3) / CVE-2020-13662

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2020-13663 - Drupal SA 2020-004

The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.

For Debian 8 'Jessie', this problem has been fixed in version 7.32-1+deb8u19.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.72, 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1 or 9.0.x prior to 9.0.1. It is, therefore, affected by multilple vulnerabilities :

 - A Cross-Site Request Forgery (CSRF) due to insufficient validation in the Drupal core Form API (CVE-2020-13663).

 - An arbitrary PHP code execution (CVE-2020-13664).

 - An access bypass due to insufficient validation in JSON:API PATCH requests (CVE-2020-13665).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that Drupal, a fully-featured content management framework, was suspectible to cross site request forgery.

For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2020-004

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.72, 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1, or 9.0.x prior to 9.0.1. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

ID	Name	Product	Family	Severity
140557	Fedora 31 : drupal7 (2020-fbb94073a1)	Nessus	Fedora Local Security Checks	high
140545	Fedora 32 : drupal7 (2020-0b32a59b54)	Nessus	Fedora Local Security Checks	high
137906	Debian DLA-2263-1 : drupal7 security update	Nessus	Debian Local Security Checks	high
112484	Drupal 7.x < 7.72 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
112483	Drupal 8.8.x < 8.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
112482	Drupal 8.9.x < 8.9.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
112481	Drupal 9.0.x < 9.0.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
137674	Debian DSA-4706-1 : drupal7 - security update	Nessus	Debian Local Security Checks	high
137636	Drupal 7.0.x < 7.72 / 8.8.x < 8.8.8 / 8.9.x < 8.9.1 / 9.0.x < 9.0.1 Multiple Vulnerabilities (drupal-2020-06-17)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2020-13663

high

Tenable Plugins

high

high

high

critical

critical

critical

critical

high

critical