Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.

The remote server is hosting an outdated version of Drupal, a PHP-based open-source content management system. The version of Drupal installed on the remote server is 7.x prior to 7.39, and is affected by the following vulnerabilities :

 - A cross-site scripting (XSS) vulnerability exists in the autocomplete functionality due to improper validation of input passed via requested URLs. An authenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code. (CVE-2015-6658)
 - A SQL injection vulnerability exists in the SQL comment filtering system due to improper sanitization of user-supplied input before using it in SQL queries. An authenticated, remote attacker can exploit this to inject SQL queries, resulting in the manipulation or disclosure of arbitrary data. (CVE-2015-6659)
 - A cross-site request forgery (CSRF) vulnerability exists in the form API due to improper validation of form tokens. An authenticated, remote attacker can exploit this, via a specially crafted link, to upload arbitrary files under another user's account. (CVE-2015-6660)
 - An information disclosure vulnerability exists that allows a remote, authenticated user to view the titles of nodes that they do not have access to. (CVE-2015-6661)
 - A cross-site scripting vulnerability exists due to improper validation of user-supplied input when invoking 'Drupal.ajax()' on whitelisted HTML elements. A remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code. (CVE-2015-6665)

The remote server is hosting an outdated version of Drupal, a PHP-based open-source content management system. The version of Drupal installed on the remote server is 6.x prior to 6.37, and is affected by the following vulnerabilities :

 - A cross-site scripting (XSS) vulnerability exists in the autocomplete functionality due to improper validation of input passed via requested URLs. An authenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code. (CVE-2015-6658)
 - A cross-site request forgery (CSRF) vulnerability exists in the form API due to improper validation of form tokens. An authenticated, remote attacker can exploit this, via a specially crafted link, to upload arbitrary files under another user's account. (CVE-2015-6660)
 - An information disclosure vulnerability exists that allows a remote, authenticated user to view the titles of nodes that they do not have access to. (CVE-2015-6661)

Maintenance and security release of the Drupal 6 series. This release fixes **security vulnerabilities**. Sites are [urged to upgrade immediately](https://www.drupal.org/node/1494290) after reading the notes below and the security announcement: [Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2015-003](https://www.drupal.org/SA-CORE-2015-003) No other fixes are included. No changes have been made to the .htaccess, robots.txt or default settings.php files in this release, so upgrading custom versions of those files is not necessary. #### Known issues:
None. #### Major changes since 6.36: * For security reasons, the autocomplete system now makes Ajax requests to non-clean URLs only, although protection is also in place for custom code that does so using clean URLs. There is a new form API #process function on autocomplete-enabled text fields that is required for the autocomplete functionality to work; custom and contributed modules should ensure that they are not overriding this #process function accidentally when altering text fields on forms. Part of the security fix also includes changes to theme_textfield(); it is recommended that sites which override this theme function make those changes as well (see the theme_textfield section of this diff for details). * When form API token validation fails (for example, when a cross-site request forgery attempt is detected, or a user tries to submit a form after having logged out and back in again in the meantime), the form API now skips calling form element value callbacks, except for a select list of callbacks provided by Drupal core that are known to be safe. In rare cases, this could lead to data loss when a user submits a form and receives a token validation error, but the overall effect is expected to be minor.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated to 7.39 * [Release notes](https://www.drupal.org/drupal-7.39-release- notes) * [Drupal Core - Critical - Multiple Vulnerabilities - SA- CORE-2015-003](https://www.drupal.org/SA-CORE-2015-003)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in Drupal, a content management framework :

  - CVE-2015-6658     The form autocomplete functionality did not properly     sanitize the requested URL, allowing remote attackers to     perform a cross-site scripting attack.

  - CVE-2015-6659     The SQL comment filtering system could allow a user with     elevated permissions to inject malicious code in SQL     comments.

  - CVE-2015-6660     The form API did not perform form token validation early     enough, allowing the file upload callbacks to be run     with untrusted input. This could allow remote attackers     to upload files to the site under another user's     account.

  - CVE-2015-6661     Users without the 'access content' permission could see     the titles of nodes that they do not have access to, if     the nodes were added to a menu on the site that the     users have access to.

  - CVE-2015-6665     Remote attackers could perform a cross-site scripting     attack by invoking Drupal.ajax() on a whitelisted HTML     element.

The remote web server is running a version of Drupal that is 7.x prior to 7.39. It is, therefore, potentially affected by the following vulnerabilities :

  - A cross-site scripting vulnerability exists in the     autocomplete functionality due to improper validation of     input passed via requested URLs. An authenticated,     remote attacker can exploit this, via a specially     crafted request, to execute arbitrary script code.
    (CVE-2015-6658)

  - A SQL injection vulnerability exists in the SQL comment     filtering system due to improper sanitization of     user-supplied input before using it in SQL queries. An     authenticated, remote attacker can exploit this to     inject SQL queries, resulting in the manipulation or     disclosure of arbitrary data. (CVE-2015-6659)

  - A cross-site request forgery vulnerability exists in the     form API due to improper validation of form tokens. An     authenticated, remote attacker can exploit this, via a     specially crafted link, to upload arbitrary files under     another user's account. (CVE-2015-6660)

  - An information disclosure vulnerability exists that     allows a remote, authenticated user to view the titles     of nodes that they do not have access to.
    (CVE-2015-6661)

  - A cross-site scripting vulnerability exists due to     improper validation of user-supplied input when invoking     Drupal.ajax() on whitelisted HTML elements. A remote     attacker can exploit this, via a specially crafted     request, to execute arbitrary script code.
    (CVE-2015-6665)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote web server is running a version of Drupal that is 6.x prior to 6.37. It is, therefore, potentially affected by the following vulnerabilities :

  - A cross-site scripting vulnerability exists in the     autocomplete functionality due to improper validation of     input passed via requested URLs. An authenticated,     remote attacker can exploit this, via a specially     crafted request, to execute arbitrary script code.
    (CVE-2015-6658)

  - A cross-site request forgery vulnerability exists in the     form API due to improper validation of form tokens. An     authenticated, remote attacker can exploit this, via a     specially crafted link, to upload arbitrary files under     another user's account. (CVE-2015-6660)

  - An information disclosure vulnerability exists that     allows a remote, authenticated user to view the titles     of nodes that they do not have access to.
    (CVE-2015-6661)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
9218	Drupal 7.x < 7.39 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
9215	Drupal 6.x < 6.37 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
85825	Fedora 22 : drupal6-6.37-1.fc22 (2015-14444)	Nessus	Fedora Local Security Checks	high
85824	Fedora 23 : drupal6-6.37-1.fc23 (2015-14443)	Nessus	Fedora Local Security Checks	high
85823	Fedora 21 : drupal6-6.37-1.fc21 (2015-14442)	Nessus	Fedora Local Security Checks	high
85815	Fedora 21 : drupal7-7.39-1.fc21 (2015-13917)	Nessus	Fedora Local Security Checks	high
85814	Fedora 22 : drupal7-7.39-1.fc22 (2015-13916)	Nessus	Fedora Local Security Checks	high
85726	Debian DSA-3346-1 : drupal7 - security update	Nessus	Debian Local Security Checks	high
85674	Fedora 23 : drupal7-7.39-1.fc23 (2015-13915)	Nessus	Fedora Local Security Checks	high
85653	Drupal 7.x < 7.39 Multiple Vulnerabilities	Nessus	CGI abuses	high
85652	Drupal 6.x < 6.37 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2015-6658

medium

Tenable Plugins

medium

medium

high

high

high

high

high

high

high

high

medium