In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details

Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details. Also a possible regression caused by CVE-2019-6339 is fixed.

For Debian 8 'Jessie', this problem has been fixed in version 7.32-1+deb8u15.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

 - A flaw exists in third-party PEAR Archive_Tar library.

 - A flaw exists in PHP's built-in phar stream wrapper that could lead to a remote code execution when performing file operations on an untrusted phar:// URI.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities were found in Drupal, a fully-featured content management framework, which could result in arbitrary code execution.

For additional information, please refer to the upstream advisories at: https://www.drupal.org/sa-core-2019-001 and https://www.drupal.org/sa-core-2019-002

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.62, 8.5.x prior to 8.5.9, or 8.6.x prior to 8.6.6. It is, therefore, affected by multiple phar handling vulnerabilities. An unauthenticated attacker could leverage these vulnerabilities to potentially perform remote code execution attacks and gain access in the context the web server user.

ID	Name	Product	Family	Severity
122320	Debian DLA-1685-1 : drupal7 security update	Nessus	Debian Local Security Checks	high
98587	Drupal 8.6.x < 8.6.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98586	Drupal 8.x < 8.5.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98585	Drupal 7.x < 7.62 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
121234	Debian DSA-4370-1 : drupal7 - security update	Nessus	Debian Local Security Checks	critical
121214	Drupal 7.x < 7.62 / 8.5.x < 8.5.9 / 8.6.x < 8.6.6 Multiple Vulnerabilities (SA-CORE-2019-001, SA-CORE-2019-002)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-6338

high

Tenable Plugins

high

critical

critical

critical

critical

critical