According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.70, 8.7.x prior to 8.7.14 or 8.8.x prior to 8.8.6. It is, therefore, affected by multilple vulnerabilities :

 - Two Cross-Site Scripting (XSS) vulnerabilities in jQuery (CVE-2020-11022 / CVE-2020-11023).

 - An open redirect due to insufficient validation of the destination query parameter in the drupal_goto() function in Drupal 7 only (CVE-2020-13662).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in Drupal, a fully-featured content management framework, which could result in an open redirect or cross-site scripting.

- https://www.drupal.org/project/drupal/releases/7.72

  - [Drupal core - Critical - Cross Site Request Forgery -     SA-CORE-2020-004](https://www.drupal.org/sa-core-2020-00     4) / CVE-2020-13663

- https://www.drupal.org/project/drupal/releases/7.71

- https://www.drupal.org/project/drupal/releases/7.70

  - [Drupal core - Moderately critical - Cross Site     Scripting -     SA-CORE-2020-002](https://www.drupal.org/sa-core-2020-00     2) / CVE-2020-11022 / CVE-2020-11023

  - [Drupal core - Moderately critical - Open Redirect -     SA-CORE-2020-003](https://www.drupal.org/sa-core-2020-00     3) / CVE-2020-13662

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.

For Debian 8 'Jessie', this problem has been fixed in version 7.32-1+deb8u18.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
112438	Drupal 7.x < 7.70 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	6/9/2020	3/14/2023	medium
112430	Drupal 8.8.x < 8.8.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	6/9/2020	3/14/2023	medium
112437	Drupal 8.7.x < 8.7.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	6/9/2020	3/14/2023	medium
136932	Debian DSA-4693-1 : drupal7 - security update	Nessus	Debian Local Security Checks	5/28/2020	12/6/2022	medium
140545	Fedora 32 : drupal7 (2020-0b32a59b54)	Nessus	Fedora Local Security Checks	9/14/2020	12/6/2022	high
137572	Debian DLA-2250-1 : drupal7 security update	Nessus	Debian Local Security Checks	6/18/2020	3/6/2024	medium
140557	Fedora 31 : drupal7 (2020-fbb94073a1)	Nessus	Fedora Local Security Checks	9/14/2020	12/6/2022	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

medium

high