Detections
Analytics
Drupal 9.3.x < 9.3.19 Multiple Vulnerabilities
high Web App Scanning Plugin ID 113314
Language:
Synopsis
Drupal 9.3.x < 9.3.19 Multiple VulnerabilitiesDescription
According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.91, 9.3.x prior to 9.3.19 or 9.4.x prior to 9.4.3. It is, therefore, affected by multiple vulnerabilities:- In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system.
- Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to.
- The protections for SA-CORE-2020-012 and SA-CORE-2019-010 did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers.
- The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.
Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update to Drupal version 9.3.19 or latest.See Also
https://www.drupal.org/project/drupal/releases/9.3.19
https://www.drupal.org/sa-core-2022-012
https://www.drupal.org/sa-core-2022-013
Plugin Details
Severity: High
ID: 113314
Type: remote
Family: Component Vulnerability
Published: 7/21/2022
Updated: 5/17/2023
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C
CVSS Score Source: CVE-2022-25277
CVSS v3
Risk Factor: High
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score Source: CVE-2022-25275
Vulnerability Information
CPE: cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Exploit Ease: No known exploits are available
Patch Publication Date: 7/20/2022
Vulnerability Publication Date: 7/20/2022
Reference Information
CVE: CVE-2022-25275, CVE-2022-25276, CVE-2022-25277, CVE-2022-25278
OWASP: 2010-A2, 2010-A4, 2010-A8, 2013-A3, 2013-A4, 2013-A7, 2013-A9, 2017-A5, 2017-A7, 2017-A9, 2021-A1, 2021-A3, 2021-A4, 2021-A6
WASC: Cross-Site Scripting, Improper Input Handling, Insufficient Authorization
CAPEC: 1, 19, 209, 441, 478, 479, 502, 503, 536, 546, 550, 551, 552, 556, 558, 562, 563, 564, 578, 588, 591, 592, 63, 85
DISA STIG: APSC-DV-000460, APSC-DV-002490, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.12.6.1, 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SC-6, sp800_53-SI-10
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-1.4.2, 4.0.2-12.5.2, 4.0.2-14.2.1, 4.0.2-5.3.3