CVE-2017-6931: Drupal Core - Settings Tray Access Bypass
Summary
CVE-2017-6931: Drupal Settings Tray access bypass. Affects drupal/core versions >= 8.4.0, < 8.4.5. Fixed in 8.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible framework for building websites and applications. The Settings Tray module in Drupal allows users to update certain data, but a vulnerability in versions 8.4.x before 8.4.5 allows unauthorized users to bypass access controls and modify data they do not have permissions for. This vulnerability can be mitigated by disabling the Settings Tray module.
Vulnerability Detail
The vulnerability in the Settings Tray module allows unauthorized users to update data they should not have access to. This can lead to unauthorized modifications of sensitive information or configuration settings. The vulnerability affects Drupal versions 8.4.x before 8.4.5. The issue arises from a lack of proper access checks in the module. While the core implementations have been fixed, other instances of the module may still be vulnerable. The vulnerability has a CVSS score of 6.5, indicating a moderate severity.
How To Fix
Minimum fixed version
8.4.5
This is the first release that contains the fix.
composer require drupal/core:8.4.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to apply the fix by updating Drupal to the latest version and reviewing custom or contributed modules.
Conclusion
The vulnerability in the Settings Tray module of Drupal allows unauthorized users to bypass access controls and modify data they should not have permissions for. To mitigate the vulnerability, it is recommended to update Drupal to version 8.4.5 or later and review custom or contributed modules. Disabling the Settings Tray module can also provide additional protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible framework for building websites and applications.
The Settings Tray module in Drupal allows users to update certain data. It provides a convenient interface for modifying configuration settings.
The vulnerability allows unauthorized users to bypass access controls and modify data they do not have permissions for. This can lead to unauthorized modifications of sensitive information or configuration settings.
The vulnerability can be fixed by updating Drupal to version 8.4.5 or later. It is also important to review any custom or contributed modules that implement the Settings Tray form and ensure proper access checks are in place.
The vulnerability can be mitigated by disabling the Settings Tray module if it is not required. This will prevent unauthorized access and modifications.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
