Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form
    input from cross-site requests, which can lead to other vulnerabilities. (CVE-2020-13663)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form     input from cross-site requests, which can lead to other vulnerabilities. (CVE-2020-13663)

Note that Nessus relies on the presence of the package as reported by the vendor.

- https://www.drupal.org/project/drupal/releases/7.72

  - [Drupal core - Critical - Cross Site Request Forgery -     SA-CORE-2020-004](https://www.drupal.org/sa-core-2020-00     4) / CVE-2020-13663

- https://www.drupal.org/project/drupal/releases/7.71

- https://www.drupal.org/project/drupal/releases/7.70

  - [Drupal core - Moderately critical - Cross Site     Scripting -     SA-CORE-2020-002](https://www.drupal.org/sa-core-2020-00     2) / CVE-2020-11022 / CVE-2020-11023

  - [Drupal core - Moderately critical - Open Redirect -     SA-CORE-2020-003](https://www.drupal.org/sa-core-2020-00     3) / CVE-2020-13662

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2020-13663 - Drupal SA 2020-004

The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.

For Debian 8 'Jessie', this problem has been fixed in version 7.32-1+deb8u19.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.72, 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1 or 9.0.x prior to 9.0.1. It is, therefore, affected by multilple vulnerabilities :

 - A Cross-Site Request Forgery (CSRF) due to insufficient validation in the Drupal core Form API (CVE-2020-13663).

 - An arbitrary PHP code execution (CVE-2020-13664).

 - An access bypass due to insufficient validation in JSON:API PATCH requests (CVE-2020-13665).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that Drupal, a fully-featured content management framework, was suspectible to cross site request forgery.

For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2020-004

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.72, 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1, or 9.0.x prior to 9.0.1. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

ID	Name	Product	Family	Severity
433795	SCA: security update for drupal/core, drupal/drupal (GHSA-m648-hpf8-qcjw)	Tenable Cloud Security	SCA Checks	high
433795	SCA: security update for drupal/core, drupal/drupal (GHSA-m648-hpf8-qcjw)	Tenable Self-Hosted Container Security	SCA Checks	high
248285	Linux Distros Unpatched Vulnerability : CVE-2020-13663	Nessus	Misc.	high
426827	Alpine: drupal7: security update to 7.72-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426827	Alpine: drupal7: security update to 7.72-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400419	Alpine: multiple drupal7 packages: security update to 7.71-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400419	Alpine: multiple drupal7 packages: security update to 7.71-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
140557	Fedora 31 : drupal7 (2020-fbb94073a1)	Nessus	Fedora Local Security Checks	high
140545	Fedora 32 : drupal7 (2020-0b32a59b54)	Nessus	Fedora Local Security Checks	high
137906	Debian DLA-2263-1 : drupal7 security update	Nessus	Debian Local Security Checks	high
112484	Drupal 7.x < 7.72 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
112483	Drupal 8.8.x < 8.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
112482	Drupal 8.9.x < 8.9.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
112481	Drupal 9.0.x < 9.0.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
137674	Debian DSA-4706-1 : drupal7 - security update	Nessus	Debian Local Security Checks	high
137636	Drupal 7.0.x < 7.72 / 8.8.x < 8.8.8 / 8.9.x < 8.9.1 / 9.0.x < 9.0.1 Multiple Vulnerabilities (drupal-2020-06-17)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2020-13663

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

critical

critical

critical

critical

high

critical