PT-2019-8593 · Drupal · Drupal

Greg Knaddison + 2 · Published 2017-06-24 · Updated 2022-05-13 · CVE-2017-6922

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal core versions prior to 8.3.4 Drupal core versions prior to 7.56

Description The issue allows an access bypass, where private files uploaded by an anonymous user are visible to all anonymous users, rather than just the user who uploaded them. This occurs on sites that allow anonymous users to upload files into a private file system.

Recommendations For Drupal core versions prior to 8.3.4, update to version 8.3.4 or later. For Drupal core versions prior to 7.56, update to version 7.56 or later.

Exploit

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2017-6922

DLA-1004-1

DSA-3897-1

GHSA-58F3-CX8P-H8JG

MGASA-2017-0198

Affected Products

Drupal

References · 23

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6922.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6922.yaml · Exploit
• https://drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6922 · Security Note
• https://osv.dev/vulnerability/GHSA-58f3-cx8p-h8jg · Vendor Advisory
• https://debian.org/security/2017/dsa-3897 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3897-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6922 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0198 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6922 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0198.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6922 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-6922 · Security Note
• https://github.com/drupal/core · Note
• https://drupal.org/project/drupal/releases/7.54 · Note