Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before     7.29 allows remote authenticated users with the administer taxonomy permission to inject arbitrary web     script or HTML via an option group label. (CVE-2014-5021)

Note that Nessus relies on the presence of the package as reported by the vendor.

Updated drupal packages fix security vulnerabilities :

An information disclosure vulnerability was discovered in Drupal before 7.27. When pages are cached for anonymous users, form state may leak between anonymous users. Sensitive or private information recorded for one anonymous user could thus be disclosed to other users interacting with the same form at the same time (CVE-2014-2983).

Multiple security issues in Drupal before 7.29, including a denial of service issue, an access bypass issue in the File module, and multiple cross-site scripting issues (CVE-2014-5019, CVE-2014-5020, CVE-2014-5021, CVE-2014-5022).

A denial of service issue exists in Drupal before 7.31, due to XML entity expansion in a publicly accessible XML-RPC endpoint.

A SQL Injection issue exists in Drupal before 7.32 due to the way the Drupal core handles prepared statements. A malicious user can inject arbitrary SQL queries, and thereby completely control the Drupal site.
This vulnerability can be exploited by remote attackers without any kind of authentication required (CVE-2014-3704).

Aaron Averill discovered that a specially crafted request can give a user access to another user's session, allowing an attacker to hijack a random session (CVE-2014-9015).

Michael Cullum, Javier Nieto and Andres Rojas Guerrero discovered that the password hashing API allows an attacker to send specially crafted requests resulting in CPU and memory exhaustion. This may lead to the site becoming unavailable or unresponsive (denial of service) (CVE-2014-9016). anonymous users (CVE-2014-9016).

Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password (CVE-2015-2559).

Under certain circumstances, malicious users can construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks. In addition, several URL-related API functions in Drupal 6 and 7 can be tricked into passing through external URLs when not intending to, potentially leading to additional open redirect vulnerabilities (CVE-2015-2749, CVE-2015-2750).

The drupal package has been updated to version 7.35 to fix this issue and other bugs. See the upstream advisory and release notes for more details.

Fixes SA-CORE-2014-003. For details refer to:
https://www.drupal.org/drupal-7.29-release-notes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote web server is running a version of Drupal that is 6.x prior to 6.32 or 7.x prior to 7.29. It is, therefore, potentially affected by the following vulnerabilities :

  - The HTTP Host header, which determines the configuration     file used by Drupal core's multisite feature, does not     properly validate header values, which may result in a     denial of service. This may also affect sites that do     not use the multisite feature. (CVE-2014-5019)

  - The File module in Drupal 7.x does not properly check     file permissions when creating attachments. This may     allow attackers to gain access to arbitrary files.
    (CVE-2014-5020)

  - The form API does not properly sanitize option group     labels in select elements, which may allow unspecified     cross-site scripting attacks. (CVE-2014-5021)

  - Forms containing a combination of an Ajax-enabled text     field and a file field may contain an unspecified     cross-site scripting vulnerability. (CVE-2014-5022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been discovered in the Drupal content management system, ranging from denial of service to cross-site scripting. More information can be found at https://www.drupal.org/SA-CORE-2014-003.

ID	Name	Product	Family	Severity
243383	Linux Distros Unpatched Vulnerability : CVE-2014-5021	Nessus	Misc.	medium
82456	Mandriva Linux Security Advisory : drupal (MDVSA-2015:181)	Nessus	Mandriva Local Security Checks	high
76878	Fedora 19 : drupal7-7.29-1.fc19 (2014-8515)	Nessus	Fedora Local Security Checks	medium
76875	Fedora 20 : drupal7-7.29-1.fc20 (2014-8485)	Nessus	Fedora Local Security Checks	medium
76619	Drupal 6.x < 6.32 / 7.x < 7.29 Multiple Vulnerabilities	Nessus	CGI abuses	medium
76606	Debian DSA-2983-1 : drupal7 - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-5021

medium

Tenable Plugins

medium

high

medium

medium

medium

medium