Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

 - A security bypass vulnerability exists in the editor module due to a failure to properly check access restrictions when adding private files with a configured text editor (e.g. CKEDITOR). An unauthenticated, remote attacker can exploit this to bypass access restrictions and disclose arbitrary files. (CVE-2017-6377)

 - A cross-site request forgery (XSRF) vulnerability exists as HTTP requests do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to cause the user to disable some blocks on sites or perform additional unintended actions. (CVE-2017-6379)

 - An unspecified flaw exists in the PHPUnit component that allows an unauthenticated, remote attacker to execute arbitrary code. Note that this vulnerability may only impact versions prior to 8.2.2. (CVE-2017-6381)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Drupal running on the remote web server is 8.x prior to 8.2.7. It is, therefore, affected by the multiple vulnerabilities :

  - A security bypass vulnerability exists in the editor     module due to a failure to properly check access     restrictions when adding private files with a configured     text editor (e.g. CKEDITOR). An unauthenticated, remote     attacker can exploit this to bypass access restrictions     and disclose arbitrary files. (CVE-2017-6377)

  - A cross-site request forgery (XSRF) vulnerability exists     as HTTP requests do not require multiple steps, explicit     confirmation, or a unique token when performing certain     sensitive actions. An unauthenticated, remote attacker     can exploit this, by convincing a user to follow a     specially crafted link, to cause the user to disable     some blocks on sites or perform additional unintended     actions. (CVE-2017-6379)

  - An unspecified flaw exists in the PHPUnit component that     allows an unauthenticated, remote attacker to execute     arbitrary code. Note that this vulnerability may only     impact versions prior to 8.2.2. (CVE-2017-6381)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Drupal Security Team reports :

CVE-2017-6377: Editor module incorrectly checks access to inline private files

CVE-2017-6379: Some admin paths were not protected with a CSRF token

CVE-2017-6381: Remote code execution

ID	Name	Product	Family	Severity
98555	Drupal 8.x < 8.2.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98554	Drupal 8.3.x < 8.3.0-rc2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
97942	Drupal 8.x < 8.2.7 Multiple Vulnerabilities (SA-2017-001)	Nessus	CGI abuses	high
97808	FreeBSD : drupal8 -- multiple vulnerabilities (2730c668-0b1c-11e7-8d52-6cf0497db129)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-6379

high

Tenable Plugins

high

high

high

high