When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly
    check access for the file being attached, resulting in an access bypass. (CVE-2017-6377)

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

 - A security bypass vulnerability exists in the editor module due to a failure to properly check access restrictions when adding private files with a configured text editor (e.g. CKEDITOR). An unauthenticated, remote attacker can exploit this to bypass access restrictions and disclose arbitrary files. (CVE-2017-6377)

 - A cross-site request forgery (XSRF) vulnerability exists as HTTP requests do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to cause the user to disable some blocks on sites or perform additional unintended actions. (CVE-2017-6379)

 - An unspecified flaw exists in the PHPUnit component that allows an unauthenticated, remote attacker to execute arbitrary code. Note that this vulnerability may only impact versions prior to 8.2.2. (CVE-2017-6381)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Drupal running on the remote web server is 8.x prior to 8.2.7. It is, therefore, affected by the multiple vulnerabilities :

  - A security bypass vulnerability exists in the editor     module due to a failure to properly check access     restrictions when adding private files with a configured     text editor (e.g. CKEDITOR). An unauthenticated, remote     attacker can exploit this to bypass access restrictions     and disclose arbitrary files. (CVE-2017-6377)

  - A cross-site request forgery (XSRF) vulnerability exists     as HTTP requests do not require multiple steps, explicit     confirmation, or a unique token when performing certain     sensitive actions. An unauthenticated, remote attacker     can exploit this, by convincing a user to follow a     specially crafted link, to cause the user to disable     some blocks on sites or perform additional unintended     actions. (CVE-2017-6379)

  - An unspecified flaw exists in the PHPUnit component that     allows an unauthenticated, remote attacker to execute     arbitrary code. Note that this vulnerability may only     impact versions prior to 8.2.2. (CVE-2017-6381)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Drupal Security Team reports :

CVE-2017-6377: Editor module incorrectly checks access to inline private files

CVE-2017-6379: Some admin paths were not protected with a CSRF token

CVE-2017-6381: Remote code execution

ID	Name	Product	Family	Severity
432887	SCA: security update for drupal/core, drupal/drupal (GHSA-w7qx-vwr9-2j3r)	Tenable Cloud Security	SCA Checks	high
432887	SCA: security update for drupal/core, drupal/drupal (GHSA-w7qx-vwr9-2j3r)	Tenable Self-Hosted Container Security	SCA Checks	high
98555	Drupal 8.x < 8.2.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98554	Drupal 8.3.x < 8.3.0-rc2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
97942	Drupal 8.x < 8.2.7 Multiple Vulnerabilities (SA-2017-001)	Nessus	CGI abuses	high
97808	FreeBSD : drupal8 -- multiple vulnerabilities (2730c668-0b1c-11e7-8d52-6cf0497db129)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-6377

high

Tenable Plugins

high

high

high

high

high

high