CVE-2017-6922
published 2019-01-22CVE-2017-6922: In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to…
PriorityP277medium6.5CVSS 3.0
AVNACLPRLUINSUCHINAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.95%
77.7th percentile
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| drupal | core | >= 7.0 < 7.56 | 7.56 |
| drupal | core | >= 8.0 < 8.3.4 | 8.3.4 |
| drupal | drupal | >= 7.0 < 7.56 | 7.56 |
| drupal | drupal | >= 7.0 < 7.56 | 7.56 |
| drupal | drupal | >= 8.0 < 8.3.4 | 8.3.4 |
| drupal | drupal | >= 8.0.0 < 8.3.4 | 8.3.4 |
| drupal | drupal_core | >= Drupal 7 < 7.55 | 7.55 |
| drupal | drupal_core | >= Drupal 8 < 8.3.3 | 8.3.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability affects Drupal sites that allow anonymous users to upload files into a private file system — detection should focus on anonymous file upload requests to private file system paths ↗
- →Access bypass occurs when private files uploaded by anonymous users are accessible to other anonymous users without session binding — monitor for unauthenticated access to private file URLs by sessions other than the uploader ↗
- ·Vulnerability is only exploitable if the Drupal site is configured to allow anonymous users to upload files AND uses a private file system — sites not meeting both conditions are not affected ↗
- ·Affected versions are Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56 ↗
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
osv6.5MEDIUM
vulncheck6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Drupal core access bypass vulnerability
osv·2022-05-13
CVE-2017-6922 [MEDIUM] Drupal core access bypass vulnerability
Drupal core access bypass vulnerability
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
GHSA
Drupal core access bypass vulnerability
ghsa·2022-05-13
CVE-2017-6922 [MEDIUM] CWE-552 Drupal core access bypass vulnerability
Drupal core access bypass vulnerability
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
OSV
CVE-2017-6922: In Drupal core 8
osv·2019-01-22·CVSS 6.5
CVE-2017-6922 [MEDIUM] CVE-2017-6922: In Drupal core 8
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
VulnCheck
Drupal Drupal Core Files or Directories Accessible to External Parties
vulncheck·2017·CVSS 6.5
CVE-2017-6922 [MEDIUM] Drupal Drupal Core Files or Directories Accessible to External Parties
Drupal Drupal Core Files or Directories Accessible to External Parties
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
Affected: Drupal Drupal Core
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitati
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-6922 drupal7: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users [epel-all]
bugzilla·2017-06-22·CVSS 6.5
CVE-2017-6922 [MEDIUM] CVE-2017-6922 drupal7: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users [epel-all]
CVE-2017-6922 drupal7: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit messag
Bugzilla
CVE-2017-6922 drupal7: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users [fedora-all]
bugzilla·2017-06-22·CVSS 6.5
CVE-2017-6922 [MEDIUM] CVE-2017-6922 drupal7: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users [fedora-all]
CVE-2017-6922 drupal7: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit me
Bugzilla
CVE-2017-6922 drupal7: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
bugzilla·2017-06-22·CVSS 6.5
CVE-2017-6922 [MEDIUM] CVE-2017-6922 drupal7: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
CVE-2017-6922 drupal7: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
External References:
https://www.drupal.org/SA-CORE-2017-003
Discussion:
Created drupal7 tracking bugs for this issue:
Affects: epel-all [bug 1464008]
Affects: fedora-all [bug 1464007]
---
All dependent bug
http://www.securityfocus.com/bid/99219http://www.securitytracker.com/id/1038781https://www.debian.org/security/2017/dsa-3897https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiplehttp://www.securityfocus.com/bid/99219http://www.securitytracker.com/id/1038781https://www.debian.org/security/2017/dsa-3897https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
2019-01-22
Published
Exploited in the wild