According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.72, 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1 or 9.0.x prior to 9.0.1. It is, therefore, affected by multilple vulnerabilities :

 - A Cross-Site Request Forgery (CSRF) due to insufficient validation in the Drupal core Form API (CVE-2020-13663).

 - An arbitrary PHP code execution (CVE-2020-13664).

 - An access bypass due to insufficient validation in JSON:API PATCH requests (CVE-2020-13665).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

- https://www.drupal.org/project/drupal/releases/7.72

  - [Drupal core - Critical - Cross Site Request Forgery -     SA-CORE-2020-004](https://www.drupal.org/sa-core-2020-00     4) / CVE-2020-13663

- https://www.drupal.org/project/drupal/releases/7.71

- https://www.drupal.org/project/drupal/releases/7.70

  - [Drupal core - Moderately critical - Cross Site     Scripting -     SA-CORE-2020-002](https://www.drupal.org/sa-core-2020-00     2) / CVE-2020-11022 / CVE-2020-11023

  - [Drupal core - Moderately critical - Open Redirect -     SA-CORE-2020-003](https://www.drupal.org/sa-core-2020-00     3) / CVE-2020-13662

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2020-13663 - Drupal SA 2020-004

The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.

For Debian 8 'Jessie', this problem has been fixed in version 7.32-1+deb8u19.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.72, 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1, or 9.0.x prior to 9.0.1. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

It was discovered that Drupal, a fully-featured content management framework, was suspectible to cross site request forgery.

For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2020-004

ID	Name	Product	Family	Published	Updated	Severity
112482	Drupal 8.9.x < 8.9.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	6/26/2020	3/14/2023	critical
112484	Drupal 7.x < 7.72 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	6/26/2020	3/14/2023	critical
112481	Drupal 9.0.x < 9.0.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	6/26/2020	3/14/2023	critical
112483	Drupal 8.8.x < 8.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	6/26/2020	3/14/2023	critical
140557	Fedora 31 : drupal7 (2020-fbb94073a1)	Nessus	Fedora Local Security Checks	9/14/2020	12/6/2022	high
137906	Debian DLA-2263-1 : drupal7 security update	Nessus	Debian Local Security Checks	7/1/2020	3/5/2024	high
137636	Drupal 7.0.x < 7.72 / 8.8.x < 8.8.8 / 8.9.x < 8.9.1 / 9.0.x < 9.0.1 Multiple Vulnerabilities (drupal-2020-06-17)	Nessus	CGI abuses	6/18/2020	5/13/2022	critical
140545	Fedora 32 : drupal7 (2020-0b32a59b54)	Nessus	Fedora Local Security Checks	9/14/2020	12/6/2022	high
137674	Debian DSA-4706-1 : drupal7 - security update	Nessus	Debian Local Security Checks	6/22/2020	3/6/2024	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

high

high

critical

high

high