The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3
    might allow remote authenticated users to bypass intended access restrictions and obtain sensitive
    Statistics information via unspecified vectors. (CVE-2016-6212)

The version of Drupal running on the remote web server is 7.x prior to 7.44 or 8.x prior to 8.1.3. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the Views module that allows an     unauthenticated, remote attacker to bypass restrictions     and disclose the number of hits collected by the     Statistics module.

  - A flaw exists in the User module due to incorrectly     granting the 'all user' role when saving user accounts.
    An authenticated, remote attacker can exploit this to     gain elevated privileges.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Drupal Security Team reports :

- Saving user accounts can sometimes grant the user all roles (User module - Drupal 7 - Moderately Critical)

- Views can allow unauthorized users to see Statistics information (Views module - Drupal 8 - Less Critical)

ID	Name	Product	Family	Severity
434935	SCA: security update for drupal/core, drupal/drupal (GHSA-rfxx-gxwc-923c)	Tenable Cloud Security	SCA Checks	medium
434935	SCA: security update for drupal/core, drupal/drupal (GHSA-rfxx-gxwc-923c)	Tenable Self-Hosted Container Security	SCA Checks	medium
91781	Drupal 7.x < 7.44 / 8.x < 8.1.3 Multiple Vulnerabilities	Nessus	CGI abuses	high
91637	FreeBSD : drupal -- multiple vulnerabilities (7932548e-3427-11e6-8e82-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-6212

medium

Tenable Plugins

medium

medium

high

high