The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.

It was discovered that there was a vulnerability existed in the user module in drupal7, a content management framework.

If some specific contributed or custom code triggers a rebuild of the user profile form, a registered user can be granted all user roles on the site. This would typically result in the user gaining administrative access.

For Debian 7 'Wheezy', this issue has been fixed in drupal7 version 7.14-2+deb7u14.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Drupal running on the remote web server is 7.x prior to 7.44 or 8.x prior to 8.1.3. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the Views module that allows an     unauthenticated, remote attacker to bypass restrictions     and disclose the number of hits collected by the     Statistics module.

  - A flaw exists in the User module due to incorrectly     granting the 'all user' role when saving user accounts.
    An authenticated, remote attacker can exploit this to     gain elevated privileges.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A privilege escalation vulnerability has been found in the User module of the Drupal content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/SA-CORE-2016-002.

Drupal Security Team reports :

- Saving user accounts can sometimes grant the user all roles (User module - Drupal 7 - Moderately Critical)

- Views can allow unauthorized users to see Statistics information (Views module - Drupal 8 - Less Critical)

ID	Name	Product	Family	Severity
92325	Debian DLA-550-1 : drupal7 security update	Nessus	Debian Local Security Checks	high
91781	Drupal 7.x < 7.44 / 8.x < 8.1.3 Multiple Vulnerabilities	Nessus	CGI abuses	high
91692	Debian DSA-3604-1 : drupal7 - security update	Nessus	Debian Local Security Checks	high
91637	FreeBSD : drupal -- multiple vulnerabilities (7932548e-3427-11e6-8e82-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-6211

high

Tenable Plugins

high

high

high

high