Security restrictions bypass in Drupal - CVE-2017-6928

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU10701

Security restrictions bypass in Drupal - CVE-2017-6928

Published: February 22, 2018 / Updated: March 23, 2018


Vulnerability identifier: #VU10701
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-6928
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to improper access check for unusual site configurations when one module is trying to grant access to the file and another is trying to deny it. A remote attacker can bypass private file access.


Affected software

Drupal
Fedora
drupal6
drupal7
drupal8

How to mitigate CVE-2017-6928

Update to version 7.57.

drupal6 - update to 6.38-2.el6
drupal7 - addressed in versions 7.57-1.el6, 7.57-1.el7, 7.57-1.fc26, 7.57-1.fc27, 7.58-1.el6, 7.58-1.el7, 7.58-1.fc26, 7.58-1.fc27, 7.58-1.fc28
drupal8 - addressed in versions 8.3.9-1.fc26, 8.4.6-3.fc27, 8.4.6-3.fc28

External References

Related Security Bulletins