Several information disclosure and cross-site scripting (XSS) vulnerabilities, including one rated critical, have been patched this week in the Drupal content management system (CMS).
The most serious of the flaws is CVE-2020-13668, a critical XSS issue affecting Drupal 8 and 9. It’s worth noting that Drupal uses the NIST Common Misuse Scoring System to determine security risk levels and critical is the second highest level, after highly critical.
The issue is a reflected XSS and exploitation is only possible under certain circumstances.
“An attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability,” reads Drupal’s description of the vulnerability, which has been independently reported by several individuals.
Another XSS flaw — this one has been rated moderately critical — impacts Drupal 7, 8 and 9, and is related to the AJAX API not disabling JSONP by default.
A second moderately-critical XSS vulnerability patched this week — this one only impacts Drupal 7 and 8 — is related to the CKEditor image caption functionality built into the Drupal core. Earlier this year, Drupal developers released updates to address a couple of XSS flaws affecting the CKEditor library.
Website developers and administrators have also been informed about a moderately-critical access bypass issue related to the experimental Workspaces module, which allows users to create multiple workspaces on a website in which they can edit content before publishing it on the live workspace.
“The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vuln ..
Support the originator by clicking the read the rest link below.
