News

Drupal and Cisco Patch Update

A few vulnerabilities have been found lately on the Chrome browser in the wild. The latest vulnerabilities have been found in Drupal and Cisco where they have addressed the vulnerabilities that been found within their products.

Drupal

Drupal has released a security advisory on the latest vulnerabilities related to Third-Party Library CKeditor. The vulnerabilities are affecting all Drupal versions between 8.7.x-dev until 8.8.x-dev which the attacker will take advantage of Ckeditor to upload any malicious exploit via Cross-Site Scripting(XSS) into the application to gain any administrator privileges.

Drupal Team has come up with the recommendation for the vulnerability such as update Drupal version (For example, Drupal 8.7.x-dev to Drupal 8.7.12 and Drupal 8.8.x-dev to Drupal 8.8.4)

Beside update Drupal version as mentioned above, the user can disable the CKeditor module to migrate the vulnerabilities

Cisco

A few days ago, Cisco has released a patch over 6 Vulnerabilities that been found in their product (SD-WAN). The vulnerabilities that been ranked as High Severity Level are listed as below:

  1. CVE-2020-3264 is an attack related to buffer overflow by exploiting sending malicious code via traffic to the affected Cisco device to gain administrator privilege over the machine
  2. CVE-2020-3265 is a vulnerability that takes advantages of privilege escalation weakness where the insider attacker will be given a privilege to root
  3. CVE-2020-3265 is also a vulnerability that used a command injection vulnerability so that an insider attacker would able to inject any arbitrary command to the device with root permission if it can be exploited.
  4. CVE-2019-16010 is an old vulnerability related to Cross-Site Scripting (XSS) which is mostly affected by the vManage user interface where the attacker can exploit via a malicious link that been send using phishing method.
  5. CVE-2019-16012 is affected vManage from an SQL Injection (SQLi) attack where it would be giving permission for the attacker to inject malicious SQL queries to a target system that redeem as an unpatched system.

Even though, there is no workaround for the vulnerabilities related to Cisco Device due no exploited have been made in the wild so far. However, the user or system administrator can initiative by upgrading to vManage version 19.2.2

Source: Drupal security advisory, Cisco SD-WAN Solution Privilege Escalation Vulnerability

Leave a Reply

Your email address will not be published. Required fields are marked *