Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result.

Multiple vulnerabilities have been been fixed in the Drupal content management framework, resulting in information disclosure, insufficient validation, cross-site scripting and cross-site request forgery.

Upstream Drupal has reported SA-CORE-2012-004 [1] which corrects multiple vulnerabilities :

1) Access bypass (User module search - Drupal 6 and 7) 2) Access bypass (Upload module - Drupal 6) 3) Arbitrary PHP code execution (File upload modules - Drupal 6 and 7)

CVEs have been requested and are not yet assigned.

These flaws have been fixed in Drupal 6.27 and 7.18.

[1] http://drupal.org/SA-CORE-2012-004

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote web server is running a version of Drupal that is 6.x prior to 6.27 or 7.x prior to 7.18. It is, therefore, potentially affected by multiple vulnerabilities :

  - An access bypass vulnerability exists that allows search     results to improperly display information about blocked     users. (CVE-2012-5651)

  - Version 6.x is affected by an information disclosure     vulnerability that allows information about uploaded     files to be displayed in RSS feeds and search results     for users that do not have the 'view uploaded files'     permission. (CVE-2012-5652)

  - An arbitrary code execution vulnerability exists due to     a failure to properly verify user-uploaded files. A     remote, authenticated attacker, using a specially named     PHP file, can bypass input validation checks, and the     uploaded file can then be executed with the privileges     of the web server user. (CVE-2012-5653)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
70401	Debian DSA-2776-1 : drupal6 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
63497	Fedora 18 : drupal6-6.27-1.fc18 / drupal7-7.18-1.fc18 (2012-20746)	Nessus	Fedora Local Security Checks	medium
63393	Fedora 16 : drupal6-6.27-1.fc16 / drupal7-7.18-1.fc16 (2012-20794)	Nessus	Fedora Local Security Checks	medium
63392	Fedora 17 : drupal6-6.27-1.fc17 / drupal7-7.18-1.fc17 (2012-20766)	Nessus	Fedora Local Security Checks	medium
63324	Drupal 6.x < 6.27 / 7.x < 7.18 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2012-5652

high

Tenable Plugins

medium

medium

medium

medium

medium