According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.73, 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6 or 9.0.x prior to 9.0.6. It is, therefore, affected by multilple vulnerabilities :

 - A Cross-Site Scripting (XSS) due to Drupal AJAX API which does not disable JSONP by default (CVE-2020-13666).

 - An access bypass due to the Workspaces module which does not sufficiently check access permissions when switching workspaces (CVE-2020-13667).

 - A Cross-Site Scripting (XSS) (CVE-2020-13668).

 - A Cross-Site Scripting (XSS) in Drupal core's built-in CKEditor image caption functionality (CVE-2020-13669).

 - An information disclosure in the File module (CVE-2020-13670).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6, or 9.0.x prior to 9.0.6. It is, therefore, affected by multiple vulnerabilities:
  - An information disclosure vulnerability exists in the File module. An authenticated, remote attacker can   exploit this, to disclose file metadata. (CVE-2020-13670).

  - An authentication bypass vulnerability exists in the Workspaces module due to insufficient checks on   assigned permissions. An unauthenticated, remote attacker can exploit this, by sending specially crafted   requests, to access restricted content before an administrator has made it publicly available (CVE-2020-13667).

  - A cross-site scripting (XSS) vulnerability exists in an undisclosed component of Drupal due to improper   validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit   this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's   browser session (CVE-2020-13368).

  - A cross-site scripting (XSS) vulnerability exists in the CKEditor image caption functionality due to improper   validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit   this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's   browser session (CVE-2020-13369).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- https://www.drupal.org/project/drupal/releases/8.9.11

- https://www.drupal.org/project/drupal/releases/8.9.10

    - https://www.drupal.org/sa-core-2020-013       (CVE-2020-28948 / CVE-2020-28949)

- https://www.drupal.org/project/drupal/releases/8.9.9

    - https://www.drupal.org/sa-core-2020-012       (CVE-2020-13671)

- https://www.drupal.org/project/drupal/releases/8.9.8

- https://www.drupal.org/project/drupal/releases/8.9.7

- https://www.drupal.org/project/drupal/releases/8.9.6

    - https://www.drupal.org/sa-core-2020-011       (CVE-2020-13670)

    - https://www.drupal.org/sa-core-2020-010       (CVE-2020-13669)

    - https://www.drupal.org/sa-core-2020-009       (CVE-2020-13668)

    - https://www.drupal.org/sa-core-2020-008       (CVE-2020-13667)

    - https://www.drupal.org/sa-core-2020-007       (CVE-2020-13666)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
112595	Drupal 8.9.x < 8.9.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/18/2020	3/14/2023	high
112594	Drupal 9.0.x < 9.0.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/18/2020	3/14/2023	high
112597	Drupal 7.x < 7.73 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/18/2020	3/14/2023	high
112596	Drupal 8.8.x < 8.8.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/18/2020	3/14/2023	high
140765	Drupal 8.8.x < 8.8.10 / 8.9.x < 8.9.6 / 9.0.x < 9.0.6 Multiple Vulnerabilities (drupal-2020-09-16)	Nessus	CGI abuses	9/24/2020	4/11/2022	high
144225	Fedora 33 : drupal8 (2020-6f1079934c)	Nessus	Fedora Local Security Checks	12/15/2020	2/1/2024	high
144247	Fedora 32 : drupal8 (2020-d50d74d6f2)	Nessus	Fedora Local Security Checks	12/15/2020	2/1/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high