PT-2018-8355 · Drupal · Drupal

Ted Bowman · Publicado 2018-03-01 · Atualizado 2022-05-13 · CVE-2017-6931

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 8.4.x before 8.4.5

Description The issue allows users to update certain data without proper permissions, specifically affecting the Settings Tray module. If a Settings Tray form is implemented in a custom or contrib module, access checks should be added. This vulnerability can be mitigated by disabling the Settings Tray module.

Recommendations For Drupal versions 8.4.x before 8.4.5, update to version 8.4.5 or later to resolve the issue. As a temporary workaround, consider disabling the Settings Tray module until the issue is resolved.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2017-6931

GHSA-7FFH-CJVG-FPR4

Produtos afetados

Drupal

Referências · 7

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6931.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6931.yaml · Exploit
• https://github.com/drupal/core · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6931 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-7ffh-cjvg-fpr4 · Aviso do Fabricante
• https://drupal.org/sa-core-2018-001 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-6931 · Aviso do Fabricante