According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.73, 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6 or 9.0.x prior to 9.0.6. It is, therefore, affected by multilple vulnerabilities :

 - A Cross-Site Scripting (XSS) due to Drupal AJAX API which does not disable JSONP by default (CVE-2020-13666).

 - An access bypass due to the Workspaces module which does not sufficiently check access permissions when switching workspaces (CVE-2020-13667).

 - A Cross-Site Scripting (XSS) (CVE-2020-13668).

 - A Cross-Site Scripting (XSS) in Drupal core's built-in CKEditor image caption functionality (CVE-2020-13669).

 - An information disclosure in the File module (CVE-2020-13670).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.73, 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6, or 9.0.x prior to 9.0.6. It is, therefore, affected by a cross-site scripting (XSS) vulnerability in the AJAX API component due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework.

CVE-2020-13666

The Drupal AJAX API did not disable JSONP by default, which could lead to cross-site scripting.

For setups that relied on Drupal's AJAX API for JSONP requests, either JSONP will need to be reenabled, or the jQuery AJAX API will have to be used instead.

See the upstream advisory for more details:
https://www.drupal.org/sa-core-2020-007

CVE-2020-13671

Drupal failed to sanitize filenames on uploaded files, which could lead to those files being served as the wrong MIME type, or being executed depending on the server configuration.

It is also recommended to check previously uploaded files for malicious extensions. For more details see the upstream advisory: https://www.drupal.org/sa-core-2020-012

For Debian 9 stretch, these problems have been fixed in version 7.52-2+deb9u12.

We recommend that you upgrade your drupal7 packages.

For the detailed security status of drupal7 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/drupal7

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- https://www.drupal.org/project/drupal/releases/8.9.11

- https://www.drupal.org/project/drupal/releases/8.9.10

    - https://www.drupal.org/sa-core-2020-013       (CVE-2020-28948 / CVE-2020-28949)

- https://www.drupal.org/project/drupal/releases/8.9.9

    - https://www.drupal.org/sa-core-2020-012       (CVE-2020-13671)

- https://www.drupal.org/project/drupal/releases/8.9.8

- https://www.drupal.org/project/drupal/releases/8.9.7

- https://www.drupal.org/project/drupal/releases/8.9.6

    - https://www.drupal.org/sa-core-2020-011       (CVE-2020-13670)

    - https://www.drupal.org/sa-core-2020-010       (CVE-2020-13669)

    - https://www.drupal.org/sa-core-2020-009       (CVE-2020-13668)

    - https://www.drupal.org/sa-core-2020-008       (CVE-2020-13667)

    - https://www.drupal.org/sa-core-2020-007       (CVE-2020-13666)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
112595	Drupal 8.9.x < 8.9.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/18/2020	3/14/2023	high
112594	Drupal 9.0.x < 9.0.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/18/2020	3/14/2023	high
112596	Drupal 8.8.x < 8.8.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/18/2020	3/14/2023	high
112597	Drupal 7.x < 7.73 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/18/2020	3/14/2023	high
140766	Drupal 7.x < 7.73 / 8.8.x < 8.8.10 / 8.9.x < 8.9.6 / 9.0.x < 9.0.6 XSS (drupal-2020-09-16)	Nessus	CGI abuses	9/24/2020	4/11/2022	medium
143138	Debian DLA-2458-1 : drupal7 security update	Nessus	Debian Local Security Checks	11/20/2020	1/20/2022	high
144225	Fedora 33 : drupal8 (2020-6f1079934c)	Nessus	Fedora Local Security Checks	12/15/2020	2/1/2024	high
144247	Fedora 32 : drupal8 (2020-d50d74d6f2)	Nessus	Fedora Local Security Checks	12/15/2020	2/1/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

medium

high

high

high