PT-2019-8592 · Drupal · Drupal

Samuel Mortenson · Published 2019-01-15 · Updated 2022-05-13 · CVE-2017-6921

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal 8 versions prior to 8.3.4

Description The issue arises from improper validation of certain fields when manipulating files through the file REST resource. This affects sites with the RESTful Web Services (rest) module enabled, where the file REST resource is enabled and allows PATCH requests. An attacker must have the ability to get or register a user account on the site with permissions to upload files and to modify the file resource.

Recommendations For versions prior to 8.3.4, update to version 8.3.4 or later to resolve the issue. As a temporary workaround, consider disabling the file REST resource or restricting access to it until the update can be applied. Additionally, restrict permissions to upload files and modify the file resource to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-6921

GHSA-H377-287M-W2R9

Affected Products

Drupal

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6921.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6921.yaml · Exploit
• https://drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6921 · Security Note
• https://osv.dev/vulnerability/GHSA-h377-287m-w2r9 · Vendor Advisory
• https://github.com/drupal/core · Note
• http://securityfocus.com/bid/99222 · Note
• https://drupal.org/SA-CORE-2017-003 · Note
• http://securitytracker.com/id/1038781 · Note