CVE-2017-6377: Drupal Core - Incorrect Access Check in Editor Module
Summary
CVE-2017-6377: Drupal editor module incorrectly checks access to inline private files. Affects drupal/core versions >= 8.2.0, < 8.2.7. Fixed in 8.2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The Editor module in Drupal allows users to add and manage content, including files. However, in versions 8.2.x before 8.2.7, the editor module does not properly check access to inline private files, leading to an access bypass vulnerability.
Vulnerability Detail
The vulnerability (CVE-2017-6377) arises when a private file is added via the editor in Drupal 8.2.x before 8.2.7. The editor fails to correctly verify access to the attached file, resulting in an access bypass. This means that unauthorized users may be able to view or modify private files, potentially exposing sensitive information or compromising the integrity of the system.
How To Fix
Minimum fixed version
8.2.7
This is the first release that contains the fix.
composer require drupal/core:8.2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the patched version of Drupal core.
Conclusion
The access bypass vulnerability in the Drupal editor module can be mitigated by upgrading to Drupal core version 8.2.7 or later. It is crucial for website administrators to promptly apply the necessary updates to ensure the security of their Drupal installations. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) used for building websites and applications.
The Editor module is a component of Drupal that allows users to create and manage content, including files.
An access bypass vulnerability occurs when a system fails to properly enforce access controls, allowing unauthorized users to bypass restrictions and gain unauthorized access to resources.
The vulnerability could allow unauthorized users to access or modify private files, potentially exposing sensitive information or compromising the integrity of the system.
To protect your Drupal installation, it is important to keep the software up to date. Ensure that you have upgraded to Drupal core version 8.2.7 or later, which includes the necessary patches to address this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
