Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.

- https://www.drupal.org/project/drupal/releases/8.9.11

- https://www.drupal.org/project/drupal/releases/8.9.10

    - https://www.drupal.org/sa-core-2020-013       (CVE-2020-28948 / CVE-2020-28949)

- https://www.drupal.org/project/drupal/releases/8.9.9

    - https://www.drupal.org/sa-core-2020-012       (CVE-2020-13671)

- https://www.drupal.org/project/drupal/releases/8.9.8

- https://www.drupal.org/project/drupal/releases/8.9.7

- https://www.drupal.org/project/drupal/releases/8.9.6

    - https://www.drupal.org/sa-core-2020-011       (CVE-2020-13670)

    - https://www.drupal.org/sa-core-2020-010       (CVE-2020-13669)

    - https://www.drupal.org/sa-core-2020-009       (CVE-2020-13668)

    - https://www.drupal.org/sa-core-2020-008       (CVE-2020-13667)

    - https://www.drupal.org/sa-core-2020-007       (CVE-2020-13666)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the instance of Drupal running on the remote web server is 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6, or 9.0.x prior to 9.0.6. It is, therefore, affected by multiple vulnerabilities:
  - An information disclosure vulnerability exists in the File module. An authenticated, remote attacker can   exploit this, to disclose file metadata. (CVE-2020-13670).

  - An authentication bypass vulnerability exists in the Workspaces module due to insufficient checks on   assigned permissions. An unauthenticated, remote attacker can exploit this, by sending specially crafted   requests, to access restricted content before an administrator has made it publicly available (CVE-2020-13667).

  - A cross-site scripting (XSS) vulnerability exists in an undisclosed component of Drupal due to improper   validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit   this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's   browser session (CVE-2020-13368).

  - A cross-site scripting (XSS) vulnerability exists in the CKEditor image caption functionality due to improper   validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit   this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's   browser session (CVE-2020-13369).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.73, 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6 or 9.0.x prior to 9.0.6. It is, therefore, affected by multilple vulnerabilities :

 - A Cross-Site Scripting (XSS) due to Drupal AJAX API which does not disable JSONP by default (CVE-2020-13666).

 - An access bypass due to the Workspaces module which does not sufficiently check access permissions when switching workspaces (CVE-2020-13667).

 - A Cross-Site Scripting (XSS) (CVE-2020-13668).

 - A Cross-Site Scripting (XSS) in Drupal core's built-in CKEditor image caption functionality (CVE-2020-13669).

 - An information disclosure in the File module (CVE-2020-13670).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
144247	Fedora 32 : drupal8 (2020-d50d74d6f2)	Nessus	Fedora Local Security Checks	high
144225	Fedora 33 : drupal8 (2020-6f1079934c)	Nessus	Fedora Local Security Checks	high
140765	Drupal 8.8.x < 8.8.10 / 8.9.x < 8.9.6 / 9.0.x < 9.0.6 Multiple Vulnerabilities (drupal-2020-09-16)	Nessus	CGI abuses	high
112597	Drupal 7.x < 7.73 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112596	Drupal 8.8.x < 8.8.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112595	Drupal 8.9.x < 8.9.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112594	Drupal 9.0.x < 9.0.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2020-13667

medium

Tenable Plugins

high

high

high

high

high

high

high