According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

 - A flaw exists in third-party PEAR Archive_Tar library.

 - A flaw exists in PHP's built-in phar stream wrapper that could lead to a remote code execution when performing file operations on an untrusted phar:// URI.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.62, 8.5.x prior to 8.5.9, or 8.6.x prior to 8.6.6. It is, therefore, affected by multiple phar handling vulnerabilities. An unauthenticated attacker could leverage these vulnerabilities to potentially perform remote code execution attacks and gain access in the context the web server user.

Two vulnerabilities were found in Drupal, a fully-featured content management framework, which could result in arbitrary code execution.

For additional information, please refer to the upstream advisories at: https://www.drupal.org/sa-core-2019-001 and https://www.drupal.org/sa-core-2019-002

A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability.

With this update a new replacement stream wrapper from typo3 project is used instead of the built-in one.

For Debian 8 'Jessie', this problem has been fixed in version 7.32-1+deb8u14.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
98587	Drupal 8.6.x < 8.6.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	1/31/2019	3/14/2023	critical
98585	Drupal 7.x < 7.62 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	1/31/2019	3/14/2023	critical
98586	Drupal 8.x < 8.5.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	1/31/2019	3/14/2023	critical
121214	Drupal 7.x < 7.62 / 8.5.x < 8.5.9 / 8.6.x < 8.6.6 Multiple Vulnerabilities (SA-CORE-2019-001, SA-CORE-2019-002)	Nessus	CGI abuses	1/16/2019	4/11/2022	critical
121234	Debian DSA-4370-1 : drupal7 - security update	Nessus	Debian Local Security Checks	1/18/2019	2/24/2020	critical
121556	Debian DLA-1659-1 : drupal7 security update	Nessus	Debian Local Security Checks	2/4/2019	1/11/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical