Drupal addressed XSS and information disclosure flaws

Drupal maintainers addressed several information disclosure and cross-site scripting (XSS) flaws in the popular content management system (CMS).

Drupal maintainers addressed several information disclosure and cross-site scripting (XSS) vulnerabilities in the popular content management system (CMS).

The most severe issue, tracked as CVE-2020-13668, is a critical reflected XSS issue affecting Drupal 8 and 9. Let’s remind that Drupal uses the NIST Common Misuse Scoring System to determine the severity of the vulnerabilities, in this system critical comess after highest level that is “highly critical”.

“An attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability.” reads the advisory.

The advisory states that the issue could be exploited only under certain conditions. The remaining flaws addressed in the CMS are rated moderately critical.

The first one is an information disclosure flaw tracked as CVE-2020-13670 XSS flaw that impacts versions 8 and 9 of the CMS.

“A vulnerability exists in the File module which allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file.” reads the advisory.

A second moderately-critical XSS vulnerability addressed this week is an access bypass flaw tracked CVE-2020-13667 that impacts Drupal 8 and 9.

“The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be edited before being published to the live workspace.” reads the advisory. “The Workspaces module doesn’t sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content.”

The last issue is a Cross-site scripting flaw tracked as CVE-2020-13669 that affects Drupal 7 and 8 and resides the CKEditor image caption feature of the Drupal core.

“Drupal core’s built-in CKEditor image caption functionality is vulnerable to XSS.” continues the advisory.

The advisory highlights that versions of Drupal 8 prior to 8.8.x have reached end of life and no longer receive security updates.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, XSS)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.