PT-2019-8593 · Drupal · Drupal

Greg Knaddison + 2 · Publicado 2017-06-24 · Atualizado 2022-05-13 · CVE-2017-6922

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal core versions prior to 8.3.4 Drupal core versions prior to 7.56

Description The issue allows an access bypass, where private files uploaded by an anonymous user are visible to all anonymous users, rather than just the user who uploaded them. This occurs on sites that allow anonymous users to upload files into a private file system.

Recommendations For Drupal core versions prior to 8.3.4, update to version 8.3.4 or later. For Drupal core versions prior to 7.56, update to version 7.56 or later.

Exploit

Correção

Files Accessible to External Parties

Enumeração de Fraquezas

CWE-552

Identificadores relacionados

CVE-2017-6922

DLA-1004-1

DSA-3897-1

GHSA-58F3-CX8P-H8JG

MGASA-2017-0198

Produtos afetados

Drupal

Referências · 23

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6922.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6922.yaml · Exploit
• https://github.com/drupal/core · Nota
• https://drupal.org/project/drupal/releases/7.54 · Nota
• https://drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6922 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-58f3-cx8p-h8jg · Aviso do Fabricante
• https://debian.org/security/2017/dsa-3897 · Aviso do Fabricante
• https://drupal.org/project/drupal/releases/7.53 · Nota
• https://osv.dev/vulnerability/DSA-3897-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-6922 · Aviso do Fabricante
• http://cgit.drupalcode.org/drupal/diff/?h=7.x&id=600c1346ed976e6f35fc2b0f907a7837f0f7c145&id2=9eebe462d1e93e785e6c028dc6cf689623c4d936 · Nota
• https://osv.dev/vulnerability/MGASA-2017-0198 · Aviso do Fabricante
• https://drupal.org/SA-CORE-2017-003 · Nota
• https://ubuntu.com/security/CVE-2017-6922 · Aviso do Fabricante