The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass
    access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by
    leveraging permission to create content or comment and upload files. (CVE-2016-3162)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass     access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by     leveraging permission to create content or comment and upload files. (CVE-2016-3162)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Drupal running on the remote web server is 7.x prior to 7.43. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the File module that allows an attacker     to view, delete, or substitute a link to a file that has     not yet been submitted or processed by a form. An     authenticated, remote attacker can exploit this, via     continuous deletion of temporary files, to block all     file uploads to a site.

  - A flaw exists in the XML-RPC system due to a failure to     limit the number of simultaneous calls being made to the     same method. A remote attacker can exploit this to     facilitate brute-force attacks.

  - A cross-site redirection vulnerability exists due to     improper validation of unspecified input before     returning it to the user, which can allow the current     path to be filled-in with an external URL. A remote     attacker can exploit this, via a crafted link, to     redirect a user to a malicious web page of the     attacker's choosing that targets weaknesses in the     client-side software or is used for phishing attacks.

  - An unspecified reflected file download flaw exists that     allows an attacker to trick a user into downloading and     running a file with arbitrary JSON-encoded content.

  - A flaw exists, related to how the user_save() API is     utilized, due to assigning improper roles when saving     user accounts. An authenticated, remote attacker can     exploit this, via crafted data added to a form or array,     to gain elevated privileges.

  - An information disclosure vulnerability exists in the     'have you forgotten your password' due to displaying the     username when a valid email address is provided. A     remote attacker can exploit this to obtain the usernames     recognized by the system.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security vulnerabilities have been found in the Drupal content management framework. For additional information, please refer to the upstream advisory at

ID	Name	Product	Family	Type	Severity
432730	SCA: security update for drupal/core, drupal/drupal (GHSA-w2pj-c8x5-jvg2)	Tenable Cloud Security	SCA Checks	Local	high
432730	SCA: security update for drupal/core, drupal/drupal (GHSA-w2pj-c8x5-jvg2)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
244539	Linux Distros Unpatched Vulnerability : CVE-2016-3162	Nessus	Misc.	Local	high
89683	Drupal 7.x < 7.43 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	medium
89004	Debian DSA-3498-1 : drupal7 - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2016-3162

high

Tenable Plugins

high

high

high

medium

high