CVE-2017-6922: Drupal Core Access Bypass Vulnerability
Summary
CVE-2017-6922: Drupal core access bypass vulnerability. Affects drupal/core across 2 version ranges.
>= 7.0, < 7.56
>= 8.0, < 8.3.4
Fixed in 7.56 or 8.3.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) written in PHP. It is widely used for building websites and applications. The Drupal core package is the foundation of the CMS and provides essential functionality. This vulnerability affects Drupal core versions 7.x prior to 7.56 and 8.x prior to 8.3.4. The vulnerability allows anonymous users to access private files that have been uploaded by other anonymous users, even if the files are not attached to any content on the site. This can lead to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability arises from a lack of access restrictions on private files uploaded by anonymous users. Normally, private files should only be visible to the user who uploaded them. However, Drupal core did not enforce this protection, allowing any anonymous user to access these files. To exploit the vulnerability, the site must allow anonymous users to upload files into a private file system. The impact of this vulnerability is moderate, as it requires specific site configurations to be affected.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0, < 7.567.56composer require drupal/core:7.56 -
>= 8.0, < 8.3.48.3.4composer require drupal/core:8.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to update to the patched versions of Drupal core.
Conclusion
The Drupal core access bypass vulnerability (CVE-2017-6922) allows anonymous users to access private files uploaded by other anonymous users. This can lead to unauthorized access to sensitive information. To mitigate the vulnerability, Drupal site administrators should update their installations to the patched versions and review site configurations. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal core is the foundational package of the Drupal content management system. It provides essential functionality for building websites and applications.
The vulnerability occurs due to a lack of access restrictions on private files uploaded by anonymous users. This allows any anonymous user to access these files.
The impact of this vulnerability is moderate, as it requires specific site configurations to be affected. It can lead to unauthorized access to private files.
To fix this vulnerability, update your Drupal installation to version 7.56 or 8.3.4 or later. Review your site configurations to ensure that anonymous users do not have permission to upload files into the private file system.
There is no specific workaround provided. The recommended solution is to update to the patched versions of Drupal core.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
