Drupal addressed XSS and information disclosure flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-13667 | Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6. NVD description · AI analysis pending | 5.3 | <1% |
| — | ||
| CVE-2020-13670 | Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. NVD description · AI analysis pending | 7.5 group max | 1% |
| — |
Full article368 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 17, 2020
Drupal maintainers addressed several information disclosure and cross-site scripting (XSS) flaws in the popular content management system (CMS).
Drupal maintainers addressed several information disclosure and cross-site scripting (XSS) vulnerabilities in the popular content management system (CMS).
The most severe issue, tracked as CVE-2020-13668, is a critical reflected XSS issue affecting Drupal 8 and 9. Let’s remind that Drupal uses the NIST Common Misuse Scoring System to determine the severity of the vulnerabilities, in this system critical comess after highest level that is “highly critical”.
“An attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability.” reads the advisory.
The advisory states that the issue could be exploited only under certain conditions. The remaining flaws addressed in the CMS are rated moderately critical.
The first one is an information disclosure flaw tracked as CVE-2020-13670 XSS flaw that impacts versions 8 and 9 of the CMS.
“A vulnerability exists in the File module which allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file.” reads the advisory.
A second moderately-critical XSS vulnerability addressed this week is an access bypass flaw tracked CVE-2020-13667 that impacts Drupal 8 and 9.
“The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be edited before being published to the live workspace.” reads the advisory. “The Workspaces module doesn’t sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content.”
The last issue is a Cross-site scripting flaw tracked as CVE-2020-13669 that affects Drupal 7 and 8 and resides the CKEditor image caption feature of the Drupal core.
“Drupal core’s built-in CKEditor image caption functionality is vulnerable to XSS.” continues the advisory.
The advisory highlights that versions of Drupal 8 prior to 8.8.x have reached end of life and no longer receive security updates.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, XSS)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/108411/hacking/drupal-xss-information-disclosure-flaws.html