Detections
Analytics
Drupal 9.0.x < 9.0.1 Multiple Vulnerabilities
critical Web App Scanning Plugin ID 112481
Language:
Synopsis
Drupal 9.0.x < 9.0.1 Multiple VulnerabilitiesDescription
According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.72, 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1 or 9.0.x prior to 9.0.1. It is, therefore, affected by multilple vulnerabilities :- A Cross-Site Request Forgery (CSRF) due to insufficient validation in the Drupal core Form API (CVE-2020-13663).
- An arbitrary PHP code execution (CVE-2020-13664).
- An access bypass due to insufficient validation in JSON:API PATCH requests (CVE-2020-13665).
Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update to Drupal version 9.0.1 or latest.See Also
https://www.drupal.org/project/drupal/releases/9.0.1
https://www.drupal.org/sa-core-2020-004
Plugin Details
Severity: Critical
ID: 112481
Type: remote
Family: Component Vulnerability
Published: 6/26/2020
Updated: 3/14/2023
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2020-13664
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2020-13665
Vulnerability Information
CPE: cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Exploit Ease: No known exploits are available
Patch Publication Date: 10/6/2020
Vulnerability Publication Date: 10/6/2020
Reference Information
CVE: CVE-2020-13663, CVE-2020-13664, CVE-2020-13665
OWASP: 2010-A1, 2010-A5, 2010-A8, 2013-A1, 2013-A7, 2013-A8, 2013-A9, 2017-A1, 2017-A5, 2017-A9, 2021-A1, 2021-A3, 2021-A6
WASC: Cross-Site Request Forgery, Insufficient Authorization, OS Commanding
CAPEC: 111, 136, 15, 183, 19, 248, 40, 43, 441, 462, 467, 478, 479, 502, 503, 536, 546, 550, 551, 552, 556, 558, 562, 563, 564, 578, 62, 75, 76
DISA STIG: APSC-DV-000460, APSC-DV-002500, APSC-DV-002510, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.12.6.1, 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SI-10, sp800_53-SI-10(5)
OWASP API: 2019-API7, 2019-API8, 2023-API8
OWASP ASVS: 4.0.2-1.4.2, 4.0.2-14.2.1, 4.0.2-4.2.2, 4.0.2-5.3.8