According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

- A flaw exists in third-party PEAR Archive_Tar library.

- A flaw exists in PHP's built-in phar stream wrapper that could lead to a remote code execution when performing file operations on an untrusted phar:// URI.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code
    execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an
    untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on
    insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is
    mitigated by the fact that such code paths typically require access to an administrative permission or an
    atypical configuration. (CVE-2019-6339)

Two vulnerabilities were found in Drupal, a fully-featured content management framework, which could result in arbitrary code execution.

For additional information, please refer to the upstream advisories at: https://www.drupal.org/sa-core-2019-001 and https://www.drupal.org/sa-core-2019-002

A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability.

With this update a new replacement stream wrapper from typo3 project is used instead of the built-in one.

For Debian 8 'Jessie', this problem has been fixed in version 7.32-1+deb8u14.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.62, 8.5.x prior to 8.5.9, or 8.6.x prior to 8.6.6. It is, therefore, affected by multiple phar handling vulnerabilities. An unauthenticated attacker could leverage these vulnerabilities to potentially perform remote code execution attacks and gain access in the context the web server user.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code     execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an     untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on     insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is     mitigated by the fact that such code paths typically require access to an administrative permission or an     atypical configuration. (CVE-2019-6339)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
98585	Drupal 7.x < 7.62 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	1/31/2019	3/14/2023	critical
98587	Drupal 8.6.x < 8.6.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	1/31/2019	3/14/2023	critical
98586	Drupal 8.x < 8.5.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	1/31/2019	3/14/2023	critical
412606	SCA: security update for drupal/core, drupal/drupal (GHSA-8cw5-rv98-5c46)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	critical
412606	SCA: security update for drupal/core, drupal/drupal (GHSA-8cw5-rv98-5c46)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	critical
121234	Debian DSA-4370-1 : drupal7 - security update	Nessus	Debian Local Security Checks	1/18/2019	2/24/2020	critical
121556	Debian DLA-1659-1 : drupal7 security update	Nessus	Debian Local Security Checks	2/4/2019	6/24/2024	critical
121214	Drupal 7.x < 7.62 / 8.5.x < 8.5.9 / 8.6.x < 8.6.6 Multiple Vulnerabilities (SA-CORE-2019-001, SA-CORE-2019-002)	Nessus	CGI abuses	1/16/2019	4/11/2022	critical
250087	Linux Distros Unpatched Vulnerability : CVE-2019-6339	Nessus	Misc.	8/15/2025	7/12/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical