CVE-2017-6922

NameCVE-2017-6922
DescriptionIn Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1004-1, DSA-3897-1
NVD severitymedium (attack range: remote)
Debian Bugs756305, 865498

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
drupal7 (PTS)jessie7.32-1+deb8u12fixed
jessie (security)7.32-1+deb8u17fixed
stretch7.52-2+deb9u8fixed
stretch (security)7.52-2+deb9u9fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
drupal7source(unstable)7.56-1medium865498
drupal7sourcejessie7.32-1+deb8u9mediumDSA-3897-1
drupal7sourcestretch7.52-2+deb9u1mediumDSA-3897-1
drupal7sourcewheezy7.14-2+deb7u16mediumDLA-1004-1
drupal8ITP756305

Notes

https://www.drupal.org/SA-CORE-2017-003
http://cgit.drupalcode.org/drupal/diff/?h=7.x&id=600c1346ed976e6f35fc2b0f907a7837f0f7c145&id2=9eebe462d1e93e785e6c028dc6cf689623c4d936

Search for package or bug name: Reporting problems