Detections
Analytics
Drupal 8.6.x < 8.6.2 Multiple Vulnerabilities
high Web App Scanning Plugin ID 98584
Language:
Synopsis
Drupal 8.6.x < 8.6.2 Multiple VulnerabilitiesDescription
According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :- A flaw exists in content moderation that could lead to an access bypass.
- A flaw exists in path module that could allow users with the administer paths to enter a particular path that triggers an open redirect.
- A flaw exists in destination query string parameter in URLs that could lead to an open redirect.
- A flaw exists in DefaultMailSystem::mail() that could lead to remote code execution.
- A flaw exists in Contextual Links module that could lead to remote code execution
Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update to Drupal version 8.6.2 or latest.See Also
Plugin Details
Severity: High
ID: 98584
Type: remote
Family: Component Vulnerability
Published: 10/31/2018
Updated: 3/14/2023
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 6.2
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: Tenable
CVSS v3
Risk Factor: High
Base Score: 7.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS Score Source: Tenable
Vulnerability Information
CPE: cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/17/2018
Vulnerability Publication Date: 10/17/2018
Reference Information
OWASP: 2010-A1, 2010-A10, 2010-A8, 2013-A1, 2013-A10, 2013-A7, 2013-A9, 2017-A1, 2017-A5, 2017-A9, 2021-A1, 2021-A3, 2021-A6
WASC: Insufficient Authorization, OS Commanding, URL Redirector Abuse
CAPEC: 136, 15, 183, 19, 248, 40, 43, 441, 478, 479, 502, 503, 536, 546, 550, 551, 552, 556, 558, 562, 563, 564, 578, 75, 76
DISA STIG: APSC-DV-000460, APSC-DV-002510, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SI-10
OWASP API: 2019-API7, 2019-API8, 2023-API8
OWASP ASVS: 4.0.2-1.4.2, 4.0.2-14.2.1, 4.0.2-5.1.5, 4.0.2-5.3.8