Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-     site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7;
    9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.
    (CVE-2020-13672)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-
    site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7;
    9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.
    (CVE-2020-13672)

Drupal Security team reports :

Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. Not all sites and users are affected, but configuration changes to prevent the exploit might be impractical and will vary between sites. Therefore, we recommend all sites update to this release as soon as possible.

ID	Name	Product	Family	Severity
253752	Linux Distros Unpatched Vulnerability : CVE-2020-13672	Nessus	Misc.	medium
433627	SCA: security update for drupal/core, drupal/drupal (GHSA-3m36-mjwj-352c)	Tenable Cloud Security	SCA Checks	medium
433627	SCA: security update for drupal/core, drupal/drupal (GHSA-3m36-mjwj-352c)	Tenable Self-Hosted Container Security	SCA Checks	medium
426127	Alpine: drupal7: security update to 7.81-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
426127	Alpine: drupal7: security update to 7.81-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400202	Alpine: multiple drupal7 packages: security update to 7.78-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400202	Alpine: multiple drupal7 packages: security update to 7.78-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
150308	FreeBSD : drupal7 -- fix possible CSS (f70ab05e-be06-11eb-b983-000c294bb613)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2020-13672

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium