Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2020-2024 and is owned by Tenable, Inc. or an Affiliate thereof.WEB_APPLICATION_SCANNING_112430
HistoryJun 09, 2020 - 12:00 a.m.

Drupal 8.8.x < 8.8.6 Multiple Vulnerabilities

2020-06-0900:00:00
This script is Copyright (C) 2020-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
33

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

0.061 Low

EPSS

Percentile

93.6%

JSON

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.70, 8.7.x prior to 8.7.14 or 8.8.x prior to 8.8.6. It is, therefore, affected by multilple vulnerabilities :

  • Two Cross-Site Scripting (XSS) vulnerabilities in jQuery (CVE-2020-11022 / CVE-2020-11023).

  • An open redirect due to insufficient validation of the destination query parameter in the drupal_goto() function in Drupal 7 only (CVE-2020-13662).

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.

No source data
VendorProductVersionCPE
drupaldrupal*cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Related

nessus 42
osv 13
openvas 23
fedora 6
atlassian 5
ibm 36
hp 2
joomla 1
attackerkb 2
debian 3
oraclelinux 4
suse 3
githubexploit 3
checkpoint_advisories 1
drupal 2
redhat 6
gentoo 1
typo3 1
altlinux 1
github 5
friendsofphp 2
alpinelinux 3
nvd 3
cve 3
prion 3
ubuntucve 3
debiancve 3
veracode 2
cvelist 3
freebsd 1
nodejs 1
packetstorm 2
redhatcve 2
f5 2
zdt 2
amazon 1
hackerone 1
ics 1
almalinux 1
nessus
nessus
Drupal 7.x < 7.70 Multiple Vulnerabilities
2020-06-09 00:00:00
Drupal 8.7.x < 8.7.14 Multiple Vulnerabilities
2020-06-09 00:00:00
Debian DSA-4693-1 : drupal7 - security update
2020-05-28 00:00:00
osv
osv
drupal7 - security update
2020-05-26 00:00:00
jquery - security update
2021-03-25 00:00:00
Persistent Cross-site Scripting vulnerability in PrivateBin
2022-04-12 20:45:22
openvas
openvas
Debian: Security Advisory (DSA-4693-1)
2020-05-28 00:00:00
Fedora: Security Advisory for drupal7 (FEDORA-2020-fbb94073a1)
2020-09-14 00:00:00
Fedora: Security Advisory for drupal7 (FEDORA-2020-0b32a59b54)
2020-09-14 00:00:00
fedora
fedora
[SECURITY] Fedora 31 Update: drupal7-7.72-1.fc31
2020-09-13 14:19:12
[SECURITY] Fedora 32 Update: drupal7-7.72-1.fc32
2020-09-13 14:28:32
[SECURITY] Fedora 32 Update: drupal8-8.9.0-1.fc32
2020-06-16 01:32:24
atlassian
atlassian
Update jQuery to avoid CVE-2020-11022 and CVE-2020-11023
2021-02-02 09:59:24
Update jQuery to avoid CVE-2020-11022 and CVE-2020-11023
2021-02-02 09:59:24
jquery 2.2.4 XSS vulnerability
2022-08-24 14:53:45
ibm
ibm
Security Bulletin: jQuery Vulnerabilities Affect IBM Emptoris Sourcing (CVE-2020-11023, CVE-2020-11022)
2020-12-03 09:54:47
Security Bulletin: Multiple vulnerabilities in jQuery affect IBM WIoTP MessageGateway (CVE-2020-11023, CVE-2020-11022)
2020-08-11 19:22:50
Security Bulletin: JQuery as used by IBM QRadar Network Packet Capture is vulnerable to Cross Site Scripting (XSS) (CVE-2020-11023, CVE-2020-11022)
2020-08-10 20:34:42
hp
hp
HPSBPI03688 rev. 1 - Certain HP Printer and MFP products - Cross-Site Scripting (XSS)
2020-09-17 00:00:00
Certain HP Printers and MFP products - Cross-Site Scripting (XSS)
2020-09-17 00:00:00
joomla
joomla
[20200604] - Core - XSS in jQuery.htmlPrefilter
2020-04-10 00:00:00
attackerkb
attackerkb
CVE-2020-11023
2020-04-29 00:00:00
CVE-2020-11022
2020-04-29 00:00:00
debian
debian
[SECURITY] [DLA 2608-1] jquery security update
2021-03-26 01:32:22
[SECURITY] [DSA 4693-1] drupal7 security update
2020-05-26 21:08:21
[SECURITY] [DLA 2250-1] drupal7 security update
2020-06-18 05:01:30
oraclelinux
oraclelinux
jquery-ui security update
2022-03-01 00:00:00
bootstrap security update
2021-08-09 00:00:00
ipa security and bug fix update
2021-03-19 00:00:00
suse
suse
Security update for otrs (moderate)
2020-11-10 00:00:00
Security update for cacti, cacti-spine (moderate)
2020-07-25 00:00:00
Security update for cacti, cacti-spine (moderate)
2020-07-28 00:00:00
githubexploit
githubexploit
Exploit for Cross-site Scripting in Jquery
2021-10-16 01:10:33
Exploit for Cross-site Scripting in Jquery
2020-04-14 19:12:01
Exploit for Cross-site Scripting in Jquery
2020-11-02 20:55:10
checkpoint_advisories
checkpoint_advisories
jQuery Cross Site Scripting (CVE-2020-11022; CVE-2020-11023)
2020-11-16 00:00:00
drupal
drupal
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002
2020-05-20 00:00:00
Drupal core - Moderately critical - Open Redirect - SA-CORE-2020-003
2020-05-20 00:00:00
redhat
redhat
(RHSA-2020:4211) Moderate: Red Hat AMQ Interconnect 1.9.0 release and security update
2020-10-08 06:44:00
(RHSA-2020:3807) Moderate: Red Hat Virtualization security, bug fix, and enhancement update
2020-09-23 15:54:23
(RHSA-2021:1846) Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update
2021-05-18 06:14:07
gentoo
gentoo
Cacti: Multiple vulnerabilities
2020-07-26 00:00:00
typo3
typo3
Cross-Site Scripting in extension "Kitodo.Presentation" (dlf)
2020-07-29 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package phpipam version 1.42.027-alt1
2020-10-21 00:00:00
github
github
Persistent Cross-site Scripting vulnerability in PrivateBin
2022-04-12 20:45:22
Drupal Core Open Redirect vulnerability
2022-05-24 17:49:27
Potential XSS vulnerability in jQuery
2020-04-29 22:19:14
friendsofphp
friendsofphp
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002
1970-01-01 00:00:00
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002
1970-01-01 00:00:00
alpinelinux
alpinelinux
CVE-2020-13662
2021-05-05 15:15:08
CVE-2020-11023
2020-04-29 21:15:11
CVE-2020-11022
2020-04-29 22:15:11
nvd
nvd
CVE-2020-13662
2021-05-05 15:15:08
CVE-2020-11022
2020-04-29 22:15:11
CVE-2020-11023
2020-04-29 21:15:11
cve
cve
CVE-2020-13662
2021-05-05 15:15:08
CVE-2020-11022
2020-04-29 22:15:11
CVE-2020-11023
2020-04-29 21:15:11
prion
prion
Open redirect
2021-05-05 15:15:00
Code injection
2020-04-29 21:15:00
Code injection
2020-04-29 22:15:00
ubuntucve
ubuntucve
CVE-2020-13662
2021-05-05 00:00:00
CVE-2020-11022
2020-04-29 00:00:00
CVE-2020-11023
2020-04-29 00:00:00
debiancve
debiancve
CVE-2020-13662
2021-05-05 15:15:00
CVE-2020-11023
2020-04-29 21:15:11
CVE-2020-11022
2020-04-29 22:15:11
veracode
veracode
Open Redirection
2021-04-29 11:52:29
Cross-Site Scripting (XSS)
2020-04-30 01:59:55
cvelist
cvelist
CVE-2020-13662
2021-05-05 14:32:03
CVE-2020-11022 Potential XSS vulnerability in jQuery
2020-04-29 00:00:00
CVE-2020-11023 Potential XSS vulnerability in jQuery
2020-04-29 00:00:00
freebsd
freebsd
Cacti -- multiple vulnerabilities
2020-07-15 00:00:00
nodejs
nodejs
Cross-Site Scripting
2020-04-30 18:19:09
packetstorm
packetstorm
jQuery 1.2 Cross Site Scripting
2021-04-14 00:00:00
jQuery 1.0.3 Cross Site Scripting
2021-04-14 00:00:00
redhatcve
redhatcve
CVE-2020-11023
2021-06-20 07:11:02
CVE-2020-11022
2020-04-29 23:09:52
f5
f5
K02453220 : jQuery vulnerability CVE-2020-11022
2020-08-03 00:00:00
K66544153 : jQuery vulnerability CVE-2020-11023
2020-08-03 00:00:00
zdt
zdt
jQuery 1.2 - Cross-Site Scripting Vulnerability
2021-04-14 00:00:00
jQuery 1.0.3 - Cross-Site Scripting Vulnerability
2021-04-14 00:00:00
amazon
amazon
Medium: ipa
2021-04-20 17:55:00
hackerone
hackerone
Reddit: CVE-2020-11022
2022-12-20 17:19:58
ics
ics
Sensormatic Electronics VideoEdge
2021-11-02 12:00:00
almalinux
almalinux
Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update
2021-05-18 06:14:07

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

0.061 Low

EPSS

Percentile

93.6%

JSON
Related for WEB_APPLICATION_SCANNING_112430
nessus42osv13openvas23fedora6atlassian5ibm36hp2joomla1attackerkb2debian3oraclelinux4suse3githubexploit3checkpoint_advisories1drupal2redhat6gentoo1typo31altlinux1github5friendsofphp2alpinelinux3nvd3cve3prion3ubuntucve3debiancve3veracode2cvelist3freebsd1nodejs1packetstorm2redhatcve2f52zdt2amazon1hackerone1ics1almalinux1