Drupal intranet and vulnerability

Here how to report a vulnerability:
https://www.drupal.org/node/101494

Hi Kelly,

The fact you haven't modified any PHP makes it more likely that there will not be any vulnerabilities found in your site. Especially if you use commonly used and popular well-maintained modules it is likely that any security vulnerabilities have been found when other people have done security audits. There are 3 major groups of vulnerabilities that might be found in any security audit of a Drupal site:

• Vulnerabilities that have not yet been found by anyone else. For these, please do report them following Drupal's process for coordinated disclosure of security issues. The security team will then work with the module maintainer to create a patch. In the unlikely event the maintainer chooses not to create a patch then there is a chance you will need to either write a patch or find a consultant to help you write a patch.
• Vulnerabilities that were introduced by configuration changes. For example, if you allow anonymous users to register and then accidentally grant an advanced permission like "administer users" to the "authenticated user" role then that has created a vulnerability in the site even though no php code was written or modified.
• Weaknesses from the perspective of the auditor which may be outside of Drupal or which Drupal generally considers to be not a vulnerability.
  For example, security auditors will often point out that Drupal core alone will dislose usernames which is documented as an acceptable practice. Or your auditor may require the site to use SSL, which is something Drupal supports but is implemented at the webserver level.

Good luck with the audit! I hope you'll follow-up and report any vulnerabilities that need to be reported or just let us know how the audit goes in general.