CVE-2017-6922
Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur.
Does this matter?
Lower severity and a low EPSS score (1.95%). Track it; it rarely justifies an emergency change on its own.
Description
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.95% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-552
- Affected
- drupal/drupal · debian/debian linux
- Source
- mlhess@drupal.org
References
- http://www.securityfocus.com/bid/99219Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038781Third Party Advisory, VDB Entry
- https://www.debian.org/security/2017/dsa-3897Third Party Advisory
- https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiplePatch, Vendor Advisory
- http://www.securityfocus.com/bid/99219Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038781Third Party Advisory, VDB Entry
- https://www.debian.org/security/2017/dsa-3897Third Party Advisory
- https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiplePatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.