Pierluigi Paganini September 17, 2020

Drupal maintainers addressed several information disclosure and cross-site scripting (XSS) flaws in the popular content management system (CMS).

Drupal maintainers addressed several information disclosure and cross-site scripting (XSS) vulnerabilities in the popular content management system (CMS).

The most severe issue, tracked as CVE-2020-13668, is a critical reflected XSS issue affecting Drupal 8 and 9. Let’s remind that Drupal uses the NIST Common Misuse Scoring System to determine the severity of the vulnerabilities, in this system critical comess after highest level that is “highly critical”.

“An attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability.” reads the advisory.

The advisory states that the issue could be exploited only under certain conditions. The remaining flaws addressed in the CMS are rated moderately critical.

The first one is an information disclosure flaw tracked as CVE-2020-13670 XSS flaw that impacts versions 8 and 9 of the CMS.

“A vulnerability exists in the File module which allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file.” reads the advisory.

A second moderately-critical XSS vulnerability addressed this week is an access bypass flaw tracked CVE-2020-13667 that impacts Drupal 8 and 9.

“The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be edited before being published to the live workspace.” reads the advisory. “The Workspaces module doesn’t sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content.”

The last issue is a Cross-site scripting flaw tracked as CVE-2020-13669 that affects Drupal 7 and 8 and resides the CKEditor image caption feature of the Drupal core.

“Drupal core’s built-in CKEditor image caption functionality is vulnerable to XSS.” continues the advisory.

The advisory highlights that versions of Drupal 8 prior to 8.8.x have reached end of life and no longer receive security updates.

Pierluigi Paganini

(SecurityAffairs – hacking, XSS)

[adrotate banner=”5″]

[adrotate banner=”13″]