Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
Drupal · Drupal Core
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 19 months before it was disclosed.
- First seen exploitedVulnCheck KEV evidence19 mo before
- Disclosedday 0
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
7 fixes in drupal/drupal over 21 months. The latest fix listed for drupal/drupal is 8.3.7.
Fixes in drupal/drupalPackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 8.3.1CVE-2017-691920 Apr 2017
- 8.3.4CVE-2017-69206 Aug 2018
- 8.3.4CVE-2017-692115 Jan 2019
- 8.3.4CVE-2017-692222 Jan 2019
- 8.3.7CVE-2017-692415 Jan 2019
- 8.3.7CVE-2017-692515 Jan 2019
- 8.3.7CVE-2017-692322 Jan 2019Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo high- or medium-confidence techniques. The 2 available links are lower confidence and listed below.
Lower-confidence links (2)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- File and Directory DiscoveryT1083 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
- Exploitation for StealthT1211 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Packagistdrupal/coreAffected: 8.0 up to 8.3.4; 7.0 up to 7.56Upgrade to 8.9.17 or later (older lines: 7.74)
- Packagistdrupal/drupalAffected: 8.0 up to 8.3.4; 7.0 up to 7.56Upgrade to 8.8.11 or later (older lines: 7.74)