In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

 - A flaw exists in the PECL YAML parser due to unsafe handling of PHP objects during certain operations. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2017-6920)

 - A flaw exists in the file REST resource due to improper validation of user-supplied input to multiple fields when manipulating files. An unauthenticated, remote attacker can exploit this to have an unspecified impact on integrity. Note that a site is only affected by this issue if it has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and the attacker can get or register a user account on the site with permissions to upload files and to modify the file resource. (CVE-2017-6921)

 - An information disclosure vulnerability exists due to a failure to ensure that private files that have been uploaded by an anonymous user but not permanently attached to content on the site are only visible to the anonymous user who uploaded them instead of all anonymous users. An unauthenticated, remote attacker can exploit this to disclose the files of other anonymous users. (CVE-2017-6922)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

-     [7.56](https://www.drupal.org/project/drupal/releases/7.
    56)

  -     [SA-CORE-2017-003](https://www.drupal.org/SA-CORE-2017-0     03)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Drupal Security Team Reports :

CVE-2017-6920: PECL YAML parser unsafe object handling.

CVE-2017-6921: File REST resource does not properly validate

CVE-2017-6922: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users.

Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system. 

For Debian 7 'Wheezy', these problems have been fixed in version 7.14-2+deb7u16.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.56 or 8.x prior to 8.3.4.
It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the PECL YAML parser due to unsafe     handling of PHP objects during certain operations. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-6920)

  - A flaw exists in the file REST resource due to improper     validation of user-supplied input to multiple fields     when manipulating files. An unauthenticated, remote     attacker can exploit this to have an unspecified impact     on integrity. Note that a site is only affected by this     issue if it has the RESTful Web Services (rest) module     enabled, the file REST resource is enabled and allows     PATCH requests, and the attacker can get or register a     user account on the site with permissions to upload     files and to modify the file resource. (CVE-2017-6921)

  - An information disclosure vulnerability exists due to a     failure to ensure that private files that have been     uploaded by an anonymous user but not permanently     attached to content on the site are only visible to the     anonymous user who uploaded them instead of all     anonymous users. An unauthenticated, remote attacker can     exploit this to disclose the files of other anonymous     users. (CVE-2017-6922)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2015-7943     Samuel Mortenson and Pere Orga discovered that the     overlay module does not sufficiently validate URLs prior     to displaying their contents, leading to an open     redirect vulnerability.

  More information can be found at   https://www.drupal.org/SA-CORE-2015-004

  - CVE-2017-6922     Greg Knaddison, Mori Sugimoto and iancawthorne     discovered that files uploaded by anonymous users into a     private file system can be accessed by other anonymous     users leading to an access bypass vulnerability.

  More information can be found at   https://www.drupal.org/SA-CORE-2017-003

ID	Name	Product	Family	Severity
98559	Drupal 7.x < 7.56 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98558	Drupal 8.x < 8.3.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
101649	Fedora 26 : drupal7 (2017-6874606e19)	Nessus	Fedora Local Security Checks	medium
101276	FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (4fc2df49-6279-11e7-be0f-6cf0497db129)	Nessus	FreeBSD Local Security Checks	critical
101216	Fedora 24 : drupal7 (2017-e8a2017b3c)	Nessus	Fedora Local Security Checks	medium
101212	Fedora 25 : drupal7 (2017-38113758e7)	Nessus	Fedora Local Security Checks	medium
101092	Debian DLA-1004-1 : drupal7 security update	Nessus	Debian Local Security Checks	medium
101063	Drupal 7.x < 7.56 / 8.x < 8.3.4 Multiple Vulnerabilities (SA-CORE-2017-003)	Nessus	CGI abuses	critical
101034	Debian DSA-3897-1 : drupal7 - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-6922

medium

Tenable Plugins

critical

critical

medium

critical

medium

medium

medium

critical

medium