Detections
Analytics
SCA: security update for drupal/core, drupal/drupal (GHSA-7ffh-cjvg-fpr4)
medium Tenable Self-Hosted Container Security Plugin ID 432515
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows
users to update certain data that they do not have the permissions for. If you have implemented a Settings
Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the
only two implementations in core, but does not harden against other such bypasses. This vulnerability can
be mitigated by disabling the Settings Tray module. (CVE-2017-6931)
See Also
Plugin Details
Severity: Medium
ID: 432515
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 8/8/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N
CVSS Score Source: CVE-2017-6931
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/13/2022
Vulnerability Publication Date: 2/21/2018
Reference Information
CVE: CVE-2017-6931
cwe: CWE-434