PT-2018-8352 · Drupal · Drupal

Anders Olsson · Published 2018-02-24 · Updated 2022-05-13 · CVE-2017-6928

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal core versions prior to 7.57

Description The issue arises when using Drupal's private file system. Under certain conditions, where one module grants access to a file and another denies it, the access check fails. This leads to an access bypass issue, although it is mitigated by the fact that it only occurs in unusual site configurations.

Recommendations For versions prior to 7.57, update to version 7.57 or later to resolve the issue.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-6928

DLA-1295-1

DSA-4123-1

GHSA-66MV-Q8R2-HJ8W

Affected Products

Drupal

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6928.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6928.yaml · Exploit
• https://debian.org/security/2018/dsa-4123 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6928 · Vendor Advisory
• https://drupal.org/sa-core-2018-001 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6928 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6928 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4123-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-6928 · Security Note
• https://osv.dev/vulnerability/GHSA-66mv-q8r2-hj8w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6928 · Security Note
• https://github.com/drupal/core · Note
• https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html · Note