A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote     code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact     that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are     running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the     <siteroot>/vendor/phpunit directory from your production deployments (CVE-2017-6381)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

 - A security bypass vulnerability exists in the editor module due to a failure to properly check access restrictions when adding private files with a configured text editor (e.g. CKEDITOR). An unauthenticated, remote attacker can exploit this to bypass access restrictions and disclose arbitrary files. (CVE-2017-6377)

 - A cross-site request forgery (XSRF) vulnerability exists as HTTP requests do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to cause the user to disable some blocks on sites or perform additional unintended actions. (CVE-2017-6379)

 - An unspecified flaw exists in the PHPUnit component that allows an unauthenticated, remote attacker to execute arbitrary code. Note that this vulnerability may only impact versions prior to 8.2.2. (CVE-2017-6381)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Drupal running on the remote web server is 8.x prior to 8.2.7. It is, therefore, affected by the multiple vulnerabilities :

  - A security bypass vulnerability exists in the editor     module due to a failure to properly check access     restrictions when adding private files with a configured     text editor (e.g. CKEDITOR). An unauthenticated, remote     attacker can exploit this to bypass access restrictions     and disclose arbitrary files. (CVE-2017-6377)

  - A cross-site request forgery (XSRF) vulnerability exists     as HTTP requests do not require multiple steps, explicit     confirmation, or a unique token when performing certain     sensitive actions. An unauthenticated, remote attacker     can exploit this, by convincing a user to follow a     specially crafted link, to cause the user to disable     some blocks on sites or perform additional unintended     actions. (CVE-2017-6379)

  - An unspecified flaw exists in the PHPUnit component that     allows an unauthenticated, remote attacker to execute     arbitrary code. Note that this vulnerability may only     impact versions prior to 8.2.2. (CVE-2017-6381)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Drupal Security Team reports :

CVE-2017-6377: Editor module incorrectly checks access to inline private files

CVE-2017-6379: Some admin paths were not protected with a CSRF token

CVE-2017-6381: Remote code execution

ID	Name	Product	Family	Severity
243869	Linux Distros Unpatched Vulnerability : CVE-2017-6381	Nessus	Misc.	high
98555	Drupal 8.x < 8.2.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98554	Drupal 8.3.x < 8.3.0-rc2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
97942	Drupal 8.x < 8.2.7 Multiple Vulnerabilities (SA-2017-001)	Nessus	CGI abuses	high
97808	FreeBSD : drupal8 -- multiple vulnerabilities (2730c668-0b1c-11e7-8d52-6cf0497db129)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-6381

high

Tenable Plugins

high

high

high

high

high