{"id":2344,"date":"2020-09-18T13:28:40","date_gmt":"2020-09-18T18:28:40","guid":{"rendered":"https:\/\/cert.pa\/?p=2344"},"modified":"2020-09-18T13:28:40","modified_gmt":"2020-09-18T18:28:40","slug":"csirt-panama-aviso-2020-09-17-drupal-vulnerabilidades-en-gestor-de-cotenidos-de-drupal","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=2344","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2020-09-17 Drupal: Vulnerabilidades en Gestor de Cotenidos de Drupal"},"content":{"rendered":"\n<p>Gravedad: Alta&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p>Fecha de publicaci\u00f3n: Septiembre 17,\n2020<br>\n\u00daltima revisi\u00f3n: Septiembre 17, 2020<br>\nPortal: https:\/\/www.drupal.org\/<\/p>\n\n\n\n<p>Sistemas Afectados: Diversas afectaciones en el gestor\nde contenido Drupal en distintas versiones &nbsp;anteriores a 9.0.6, 8.9.6, 8.8.10, 7.73.<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Descripci\u00f3n<\/strong><\/li><\/ol>\n\n\n\n<p>Mitigaci\u00f3n para 5 vulnerabilidades que afectan al core\nde Drupal, una de severidad alta y el resto medias, de tipos XSS, omisi\u00f3n de\nautenticaci\u00f3n y divulgaci\u00f3n de informaci\u00f3n.<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Impacto<\/strong><\/li><\/ol>\n\n\n\n<p><strong>Vulnerabilidad:<\/strong> CVE-2020-13668<\/p>\n\n\n\n<p>La vulnerabilidad de severidad m\u00e1s alta es de tipo\nXSS reflejado, y podr\u00eda permitir que un atacante aprovechara la forma en que se\nrepresenta HTML para los formularios afectados. <\/p>\n\n\n\n<p>Vulnerabilidades con menor criticidad: CVE-2020-13666,\nCVE-2020-13667, CVE-2020-13669 y CVE-2020-13670.<\/p>\n\n\n\n<p><strong>III. Referencia a soluciones, herramientas e\ninformaci\u00f3n<\/strong><strong><\/strong><\/p>\n\n\n\n<p>Se recomienda actualizar el gestor de contenido\nDrupal seg\u00fan cada versi\u00f3n, mediante su sitio oficial: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Actualizar\na la versi\u00f3n 9.0.6, Enlace: <a href=\"https:\/\/www.drupal.org\/project\/drupal\/releases\/9.0.6\">https:\/\/www.drupal.org\/project\/drupal\/releases\/9.0.6<\/a><\/li><li>Actualizar\na la versi\u00f3n 8.9.6, Enlace: <a href=\"https:\/\/www.drupal.org\/project\/drupal\/releases\/8.9.6\">https:\/\/www.drupal.org\/project\/drupal\/releases\/8.9.6<\/a><\/li><li>Actualizar\na la versi\u00f3n 8.8.10, Enlace: <a href=\"https:\/\/www.drupal.org\/project\/drupal\/releases\/8.8.10\">https:\/\/www.drupal.org\/project\/drupal\/releases\/8.8.10<\/a><\/li><li>Actualizar\na la versi\u00f3n 7.73, Enlace: <a href=\"https:\/\/www.drupal.org\/project\/drupal\/releases\/7.73\">https:\/\/www.drupal.org\/project\/drupal\/releases\/7.73<\/a><\/li><\/ul>\n\n\n\n<p>Las versiones de Drupal 8 anteriores a 8.8.x est\u00e1n\nal final de su vida \u00fatil y ya no reciben cobertura de seguridad. Los portales\nen versiones 8.7.x o anterior deber\u00e1n actualizarse a 8.8.10.<\/p>\n\n\n\n<p><strong>Fuentes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Drupal. Moderately\ncritical, Cross-site scripting, SA-CORE-2020-007. Recopilado en: https:\/\/www.drupal.org\/sa-core-2020-007<\/li><li>Drupal. Moderately\ncritical, Access bypass, SA-CORE-2020-008. Recopilado en: https:\/\/www.drupal.org\/sa-core-2020-008<\/li><li>Drupal. Critical,\nCross-site scripting, SA-CORE-2020-009. Recopilado en: <a href=\"https:\/\/www.drupal.org\/sa-core-2020-009\">https:\/\/www.drupal.org\/sa-core-2020-009<\/a><\/li><li>Drupal. Moderately\ncritical, Cross-site scripting, SA-CORE-2020-010. Recopilado en:\nhttps:\/\/www.drupal.org\/sa-core-2020-010<\/li><li>Drupal.\nModerately critical, Information disclosure, SA-CORE-2020-011. Recopilado en:\nhttps:\/\/www.drupal.org\/sa-core-2020-011<\/li><li>Instituto\nNacional de Ciberseguridad (INCIBE). 17 de septiembre del 2020.\nVulnerabilidades. Recopilado\nen: https:\/\/www.incibe-cert.es\/alerta-temprana\/avisos-seguridad\/vulnerabilidades-el-core-drupal-1<\/li><\/ul>\n\n\n\n<p><strong>Informaci\u00f3n de contacto<\/strong><br>\nCSIRT PANAMA<br>\nComputer Security Incident Response Team Autoridad Nacional para la Innovacion\nGubernamental<br>\nE-Mail: info@cert.pa<br>\nPhone: +507 520-CERT (2378)<br>\nWeb: https:\/\/cert.pa<br>\nTwitter: @CSIRTPanama<br>\nKey ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Gravedad: Alta&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Fecha de publicaci\u00f3n: Septiembre 17, 2020 \u00daltima revisi\u00f3n: Septiembre 17, 2020 Portal: https:\/\/www.drupal.org\/ Sistemas Afectados: Diversas afectaciones en el gestor de contenido Drupal en distintas versiones &nbsp;anteriores a 9.0.6, 8.9.6, 8.8.10, 7.73. Descripci\u00f3n&#8230;<\/p>\n","protected":false},"author":4,"featured_media":941,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[72,10],"class_list":["post-2344","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad","tag-avisos-de-seguridad","tag-drupal"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2344"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2344\/revisions"}],"predecessor-version":[{"id":2345,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2344\/revisions\/2345"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/941"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}