Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML
    parser not handling PHP objects safely during certain operations. (CVE-2017-6920)

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

- A flaw exists in the PECL YAML parser due to unsafe handling of PHP objects during certain operations. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2017-6920)

- A flaw exists in the file REST resource due to improper validation of user-supplied input to multiple fields when manipulating files. An unauthenticated, remote attacker can exploit this to have an unspecified impact on integrity. Note that a site is only affected by this issue if it has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and the attacker can get or register a user account on the site with permissions to upload files and to modify the file resource. (CVE-2017-6921)

- An information disclosure vulnerability exists due to a failure to ensure that private files that have been uploaded by an anonymous user but not permanently attached to content on the site are only visible to the anonymous user who uploaded them instead of all anonymous users. An unauthenticated, remote attacker can exploit this to disclose the files of other anonymous users. (CVE-2017-6922)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Drupal Security Team Reports :

CVE-2017-6920: PECL YAML parser unsafe object handling.

CVE-2017-6921: File REST resource does not properly validate

CVE-2017-6922: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.56 or 8.x prior to 8.3.4.
It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the PECL YAML parser due to unsafe     handling of PHP objects during certain operations. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-6920)

  - A flaw exists in the file REST resource due to improper     validation of user-supplied input to multiple fields     when manipulating files. An unauthenticated, remote     attacker can exploit this to have an unspecified impact     on integrity. Note that a site is only affected by this     issue if it has the RESTful Web Services (rest) module     enabled, the file REST resource is enabled and allows     PATCH requests, and the attacker can get or register a     user account on the site with permissions to upload     files and to modify the file resource. (CVE-2017-6921)

  - An information disclosure vulnerability exists due to a     failure to ensure that private files that have been     uploaded by an anonymous user but not permanently     attached to content on the site are only visible to the     anonymous user who uploaded them instead of all     anonymous users. An unauthenticated, remote attacker can     exploit this to disclose the files of other anonymous     users. (CVE-2017-6922)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
434203	SCA: security update for drupal/core, drupal/drupal (GHSA-9c24-g32g-35rj)	Tenable Cloud Security	SCA Checks	Local	critical
434203	SCA: security update for drupal/core, drupal/drupal (GHSA-9c24-g32g-35rj)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
98559	Drupal 7.x < 7.56 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98558	Drupal 8.x < 8.3.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
101276	FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (4fc2df49-6279-11e7-be0f-6cf0497db129)	Nessus	FreeBSD Local Security Checks	Local	critical
101063	Drupal 7.x < 7.56 / 8.x < 8.3.4 Multiple Vulnerabilities (SA-CORE-2017-003)	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2017-6920

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical