Several information disclosure and cross-site scripting (XSS) vulnerabilities, including one rated critical, have been patched this week in the Drupal content management system (CMS).
The most serious of the flaws is CVE-2020-13668, a critical XSS issue affecting Drupal 8 and 9. It’s worth noting that Drupal uses the NIST Common Misuse Scoring System to determine security risk levels and critical is the second highest level, after highly critical.
The issue is a reflected XSS and exploitation is only possible under certain circumstances.
“An attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability,” reads Drupal’s description of the vulnerability, which has been independently reported by several individuals.
Another XSS flaw — this one has been rated moderately critical — impacts Drupal 7, 8 and 9, and is related to the AJAX API not disabling JSONP by default.
A second moderately-critical XSS vulnerability patched this week — this one only impacts Drupal 7 and 8 — is related to the CKEditor image caption functionality built into the Drupal core. Earlier this year, Drupal developers released updates to address a couple of XSS flaws affecting the CKEditor library.
Website developers and administrators have also been informed about a moderately-critical access bypass issue related to the experimental Workspaces module, which allows users to create multiple workspaces on a website in which they can edit content before publishing it on the live workspace.
“The Workspaces module doesn’t sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content,” Drupal developers explained.
Finally, Drupal is also affected by a moderately-critical vulnerability in the File module that can be exploited to gain access to the metadata of a private file by guessing its ID.
Drupal users have also been provided instructions on the steps they may need to take in addition to updating their installations.
Versions of Drupal 8 prior to 8.8.x have reached end of life and no longer receive security updates.
Related: XSS, Open Redirect Vulnerabilities Patched in Drupal
Related: Drupal Patches Code Execution Flaw Most Likely to Impact Windows Servers
Related: Critical Drupal Vulnerability Allows Remote Code Execution