According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.70, 7.0.x prior to 7.70, 8.7.x prior to 8.7.14, or 8.8.x prior to 8.8.6. It is, therefore, affected by multiple vulnerabilities.

  - In jQuery versions greater than or equal to 1.2 and     before 3.5.0, passing HTML from untrusted sources - even     after sanitizing it - to one of jQuery's DOM     manipulation methods (i.e. .html(), .append(), and     others) may execute untrusted code. This problem is     patched in jQuery 3.5.0. (CVE-2020-11022)

  - In jQuery versions greater than or equal to 1.0.3 and     before 3.5.0, passing HTML containing  elements     from untrusted sources - even after sanitizing it - to     one of jQuery's DOM manipulation methods (i.e. .html(),     .append(), and others) may execute untrusted code. This     problem is patched in jQuery 3.5.0. (CVE-2020-11023)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Drupal 7.0.x < 7.70 / 7.0.x < 7.70 / 8.7.x < 8.7.14 / 8.8.x < 8.8.6 Multiple Vulnerabilities (drupal-2020-05-20)

medium Nessus Plugin ID 136745

Version 1.6