Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

- https://www.drupal.org/project/drupal/releases/8.9.11

- https://www.drupal.org/project/drupal/releases/8.9.10

    - https://www.drupal.org/sa-core-2020-013       (CVE-2020-28948 / CVE-2020-28949)

- https://www.drupal.org/project/drupal/releases/8.9.9

    - https://www.drupal.org/sa-core-2020-012       (CVE-2020-13671)

- https://www.drupal.org/project/drupal/releases/8.9.8

- https://www.drupal.org/project/drupal/releases/8.9.7

- https://www.drupal.org/project/drupal/releases/8.9.6

    - https://www.drupal.org/sa-core-2020-011       (CVE-2020-13670)

    - https://www.drupal.org/sa-core-2020-010       (CVE-2020-13669)

    - https://www.drupal.org/sa-core-2020-009       (CVE-2020-13668)

    - https://www.drupal.org/sa-core-2020-008       (CVE-2020-13667)

    - https://www.drupal.org/sa-core-2020-007       (CVE-2020-13666)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework.

CVE-2020-13666

The Drupal AJAX API did not disable JSONP by default, which could lead to cross-site scripting.

For setups that relied on Drupal's AJAX API for JSONP requests, either JSONP will need to be reenabled, or the jQuery AJAX API will have to be used instead.

See the upstream advisory for more details:
https://www.drupal.org/sa-core-2020-007

CVE-2020-13671

Drupal failed to sanitize filenames on uploaded files, which could lead to those files being served as the wrong MIME type, or being executed depending on the server configuration.

It is also recommended to check previously uploaded files for malicious extensions. For more details see the upstream advisory: https://www.drupal.org/sa-core-2020-012

For Debian 9 stretch, these problems have been fixed in version 7.52-2+deb9u12.

We recommend that you upgrade your drupal7 packages.

For the detailed security status of drupal7 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/drupal7

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.73, 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6, or 9.0.x prior to 9.0.6. It is, therefore, affected by a cross-site scripting (XSS) vulnerability in the AJAX API component due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.73, 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6 or 9.0.x prior to 9.0.6. It is, therefore, affected by multilple vulnerabilities :

 - A Cross-Site Scripting (XSS) due to Drupal AJAX API which does not disable JSONP by default (CVE-2020-13666).

 - An access bypass due to the Workspaces module which does not sufficiently check access permissions when switching workspaces (CVE-2020-13667).

 - A Cross-Site Scripting (XSS) (CVE-2020-13668).

 - A Cross-Site Scripting (XSS) in Drupal core's built-in CKEditor image caption functionality (CVE-2020-13669).

 - An information disclosure in the File module (CVE-2020-13670).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
144247	Fedora 32 : drupal8 (2020-d50d74d6f2)	Nessus	Fedora Local Security Checks	high
144225	Fedora 33 : drupal8 (2020-6f1079934c)	Nessus	Fedora Local Security Checks	high
143138	Debian DLA-2458-1 : drupal7 security update	Nessus	Debian Local Security Checks	high
140766	Drupal 7.x < 7.73 / 8.8.x < 8.8.10 / 8.9.x < 8.9.6 / 9.0.x < 9.0.6 XSS (drupal-2020-09-16)	Nessus	CGI abuses	medium
112597	Drupal 7.x < 7.73 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112596	Drupal 8.8.x < 8.8.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112595	Drupal 8.9.x < 8.9.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112594	Drupal 9.0.x < 9.0.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2020-13666

medium

Tenable Plugins

high

high

high

medium

high

high

high

high