vulnwire
6.5med

CVE-2017-6922

Files uploaded by anonymous users into a private file system can be accessed by other anonymous users

Also known as GHSA-58f3-cx8p-h8jg

Published 7 y ago · modified 4 mo ago · JSON

CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.9%
percentile 80%
Public exploits
0
none known

In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.

Exploit prediction (EPSS)

1.95% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD2.04.0AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub3.06.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
packagistdrupal/core
>=7.0, <7.56
>=8.0, <8.3.4
7.56
8.3.4
packagistdrupal/drupal
>=8.0, <8.3.4
>=7.0, <7.56
8.3.4
7.56

Affected products

  • Drupal Drupal Core

Classification

Weakness
  • CWE-552 Files or Directories Accessible to External Parties

References

  • debian.org /security/2017/dsa-3897 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securityfocus.com /bid/99219 · vdb-entry, x_refsource_BID, x_transferred
  • drupal.org /forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1038781 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-6922 · advisory
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6922.yaml · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6922.yaml · web
  • github.com /drupal/core · package
  • drupal.org /SA-CORE-2017-003 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.