PT-2018-8352 · Drupal · Drupal

Anders Olsson · Publicado 2018-02-24 · Atualizado 2022-05-13 · CVE-2017-6928

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal core versions prior to 7.57

Description The issue arises when using Drupal's private file system. Under certain conditions, where one module grants access to a file and another denies it, the access check fails. This leads to an access bypass issue, although it is mitigated by the fact that it only occurs in unusual site configurations.

Recommendations For versions prior to 7.57, update to version 7.57 or later to resolve the issue.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2017-6928

DLA-1295-1

DSA-4123-1

GHSA-66MV-Q8R2-HJ8W

Produtos afetados

Drupal

Referências · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6928.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6928.yaml · Exploit
• https://github.com/drupal/core · Nota
• https://debian.org/security/2018/dsa-4123 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6928 · Aviso do Fabricante
• https://drupal.org/sa-core-2018-001 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-6928 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-6928 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4123-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-6928 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-66mv-q8r2-hj8w · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6928 · Nota de Segurança