PT-2019-8592 · Drupal · Drupal

Samuel Mortenson · Publicado 2019-01-15 · Atualizado 2022-05-13 · CVE-2017-6921

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal 8 versions prior to 8.3.4

Description The issue arises from improper validation of certain fields when manipulating files through the file REST resource. This affects sites with the RESTful Web Services (rest) module enabled, where the file REST resource is enabled and allows PATCH requests. An attacker must have the ability to get or register a user account on the site with permissions to upload files and to modify the file resource.

Recommendations For versions prior to 8.3.4, update to version 8.3.4 or later to resolve the issue. As a temporary workaround, consider disabling the file REST resource or restricting access to it until the update can be applied. Additionally, restrict permissions to upload files and modify the file resource to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-6921

GHSA-H377-287M-W2R9

Produtos afetados

Drupal

Referências · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6921.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6921.yaml · Exploit
• https://github.com/drupal/core · Nota
• https://drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple · Aviso do Fabricante
• http://securityfocus.com/bid/99222 · Nota
• https://osv.dev/vulnerability/CVE-2017-6921 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6921 · Nota de Segurança
• https://drupal.org/SA-CORE-2017-003 · Nota
• http://securitytracker.com/id/1038781 · Nota
• https://osv.dev/vulnerability/GHSA-h377-287m-w2r9 · Aviso do Fabricante