Detections
Analytics

Drupal 8.x < 8.2.7 Multiple Vulnerabilities (SA-2017-001)

high Nessus Plugin ID 97942

Language:

Synopsis

A PHP application running on the remote web server is affected by multiple vulnerabilities.

Description

The version of Drupal running on the remote web server is 8.x prior to 8.2.7. It is, therefore, affected by the multiple vulnerabilities :

 - A security bypass vulnerability exists in the editor module due to a failure to properly check access restrictions when adding private files with a configured text editor (e.g. CKEDITOR). An unauthenticated, remote attacker can exploit this to bypass access restrictions and disclose arbitrary files. (CVE-2017-6377)

 - A cross-site request forgery (XSRF) vulnerability exists as HTTP requests do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to cause the user to disable some blocks on sites or perform additional unintended actions. (CVE-2017-6379)

 - An unspecified flaw exists in the PHPUnit component that allows an unauthenticated, remote attacker to execute arbitrary code. Note that this vulnerability may only impact versions prior to 8.2.2. (CVE-2017-6381)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Drupal version 8.2.7 or later. Additionally, as a workaround for CVE-2017-6381, remove the /vendor/phpunit directory.

See Also

https://www.drupal.org/SA-2017-001

https://www.drupal.org/project/drupal/releases/8.2.7

Plugin Details

Severity: High

ID: 97942

File Name: drupal_8_2_7.nasl

Version: 1.8

Type: remote

Family: CGI abuses

Published: 3/24/2017

Updated: 4/11/2022

Configuration: Enable paranoid mode, Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:X

Vulnerability Information

CPE: cpe:/a:drupal:drupal

Required KB Items: www/PHP, Settings/ParanoidReport, installed_sw/Drupal

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/15/2017

Vulnerability Publication Date: 3/15/2017

Reference Information

CVE: CVE-2017-6377, CVE-2017-6379, CVE-2017-6381

BID: 96919